params to post methods in openapi scan

[Julia Khanbekova]

Hi, Simon!

I run the following scan:
1. First, I import all addresses using the openapi scan type from openapi.json
2. Then I run an active scan for the imported addresses

The service for which I run scan also has post methods. For example, the method for creating a project (create_project). The method takes the project name as input. After the active scan, several projects with strange names are created in my service (ZAP, c/:, ../../../../).

There are two questions from this:
1. I would like to understand why this happens and how zap chooses which parameters to submit to post methods?
2. Why are parameters not submitted for other post methods and requests are not sent, only in the create_project method.

[Simon Bennetts]

Hiya,

ZAP scan rules send payloads to parameters in order to find potential vulnerabilities.

The payloads you mentioned look like path traversal attacks.

There are _lots_ of "parameters" that ZAP could attack (we call them input vectors), so we make it possible for you to choose which ones it will attack.

See https://www.zaproxy.org/docs/desktop/ui/dialogs/options/ascaninput/

ZAP will attack all of the input vectors. Chances are that your other forms are filtering out "bad" input which is why you are not seeing it reflected in your app.

Cheers,

Simon

[Julia Khanbekova]

Thanks for the answer!
How can i disable path traversal attacks?

[kingthorin+zap]

https://www.zaproxy.org/docs/desktop/start/features/scanpolicy/