Context Checking Strategies

[Avani Shah]

Hello,

We are looking into using the context checking strategy of poll_url, and want to add additional polling_data. What should be the format of the polling_data? The polling headers I believe should be "Header Key: Header Value"\n"Header Key: Header Value" but would that be correct or is there a different format expected? Some examples for these two fields would be great.

Thank you,
Avani Shah 

[Simon Bennetts]

Hi Avani,

If you are using the ZAP desktop, then look at the top right of the Session Properties / Authentication screen.

Theres a little (?) icon.

Click that and it will take you to the relevant help for whichever screen you are on.

In this case it will point you to this info: https://www.zaproxy.org/docs/desktop/ui/dialogs/session/context-auth/

That does have more info for those fields.

If you have any more questions about it then feel free to ask them here.

Cheers,

Simon

[Avani Shah]

There isn't much information about what the expected format is for the pollData field. Is it expected to be an encoded JSON data as a string?

"{\"polling_id\": \"12345\", \"timestamp\": \"2023-10-10T12:34:56Z\", \"polling_type\": \"temperature\", \"polling_value\": \"22.5\", \"unit\": \"Celsius\"}" I am not able to see what is sent in ZAP in the ZAP log, is there somewhere I should look for this information?

[Simon Bennetts]

Thats because we do not know what the expected format is :D

You are specifying the URL to poll in the target app.

If you dont know what data to send then you need to find that out :)

You will typically launch a browser from ZAP, manually authenticate and then look at the requests in order to find a suitable one to use for verification.

If it is a POST request then you cab just copy the data from that.

Alternatively you can ask ZAP to auto detect it.

https://www.zaproxy.org/docs/getting-further/authentication/auto-detection/

Cheers,

Simon