How to manually reproduce the cross site scripting error from the zap results

[winx...@gmail.com]

Hi Team, 

I have reported cross site scripting reflected by the zaproxy, but being new to this, not sure how do i reproduce the error manually ?

The results i have got is , url , parameter and attack info. 

winxlinx

[Simon Bennetts]

Hi winxlinx,

That depends on various things:

• Is this a reflected XSS or a stored one?
• If its reflected, is it via a GET request or a POST?
• Are you using the ZAP UI or the API?
  

If its a reflected XSS that uses a GET request and you're using the UI then you can just right click the relevant alert in the Alerts tree and "Open URL in browser".
You can also select the full URL from the alert and paste that into a browser if you wish.

In the other cases you'll need to paste the URL into your browser, identify the field that the 'parameter' refers to and supply the 'attack' as the field value.
If its a stored XSS attack then the page attacked may be different to the one where the evidence was discovered.

Note that ZAP identifies XSSs by analysing the context in the HTML that the user input appears in and escaping out of it. It doesnt check that the specific attack used actually worked.
So dont be surprised if you dont get an alert popup, you may need to tweak the attack to get it to run.
If you have problems with any specific attack then please post sanitized details here and we'll try to help :)

Note that you can also right click an alert and "Generate Zest script for alert" - this generates a Zest script which can automate the process, but again you may need to tweak the attack.

Does that help?

Cheers,

Simon

[timo....@owasp.org]

Have you turned off xss filtering in firefox?

[winx...@gmail.com]

I am not using  xss filtering in firefox !, is there a tool like that 

[kingthorin+owaspzap]

It's turned on by default:
https://www.phillips321.co.uk/2012/03/01/xss-browser-filters-disabling-it-for-app-testing/

[kingthorin+owaspzap]

For some unfortunate reason it seems this discussion has moved to email (which seems to be happening with google groups a lot lately :( ), I'm going to attempt to bring it back here:

---------- Forwarded message ----------
From: Winx Linx
Date: Fri, Jul 31, 2015 at 8:41 AM
Subject: Re: How to manually reproduce the cross site scripting error from the zap results
To: kingthorin+owaspzap

OK, we need to disable in order to get the popup manually ?

Assuming it's a reflected XSS then yes you may need to disable that in order to get it to pop manually. Try it, you have nothing to lose, you can always switch the setting back.