authenticated urls

[Nicollas Teixeira]

im trying to automate scan using docker but now im trying to run it first on gui. I wasn't understanding why it only found the target url and didn't attack the later urls, I just realized that in the spider it is considered out of context, how can I fix this? I already tried to put in the option "include in context" but still getting only results to the main url and not the branch of all sub pages.

[psiinon]

Hiya,

Can you explain a bit more please?

You title is "authenticated urls" while you also mention the URLs being out of context.

What exactly are you doing, what happens and why do you think thats a problem?

Many thanks,

Simon

On Tue, Aug 15, 2023 at 9:48 PM Nicollas Teixeira <nicollas...@gmail.com> wrote:

im trying to automate scan using docker but now im trying to run it first on gui. I wasn't understanding why it only found the target url and didn't attack the later urls, I just realized that in the spider it is considered out of context, how can I fix this? I already tried to put in the option "include in context" but still getting only results to the main url and not the branch of all sub pages.

--
You received this message because you are subscribed to the Google Groups "ZAP User Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to zaproxy-user...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/zaproxy-users/09850d97-42f1-4c24-ac29-480923289c67n%40googlegroups.com.

--

ZAP Project leader

[Nicollas Teixeira]

Im trying to scan my url and i have the authentication tester context included with my post login url (like authenticated urls), when i run spider it says "out of context" in my authenticated urls... im using the target url but i want to scan the subpages also post auth

[psiinon]

Ah ok.

Add them to the context then :)

However sub pages should be in scope by default.

If you could give us some examples that would help - replacing sensitive information, so like https://www.example.com/login

Cheers,

Simon

To view this discussion on the web visit https://groups.google.com/d/msgid/zaproxy-users/9f7cf91b-311a-46c6-9a35-5caf66b20620n%40googlegroups.com.

--

ZAP Project leader

[Nicollas Teixeira]

Sure! Im adding in the context all the subpages which i would like to scan in addition to my target main url, like:

in authentication tester im using example.com/login and using my username and password, by default, it is creating a new context and it is spidering the post login pages, but i cant run an active scan with the post login pages, it runs only in the main target url, even if im adding in the context like example.com/postlogin and example.com/postlogin2. 

Now, im basically trying to make it work with GUI because i intend to do the same using docker, i want to automate my scans and if i can do it by GUI, i would export the context and replace with environment variables to automate similar works with the same context structure.

[psiinon]

How are you running the active scan?

What parameters are you providing?

You will need to choose the relevant context and specify the user you want to use.

Cheers,

Simon

To view this discussion on the web visit https://groups.google.com/d/msgid/zaproxy-users/62522c2b-fa59-47bb-afd7-418e51f4061bn%40googlegroups.com.

--

ZAP Project leader

[Nicollas Teixeira]

That's exactly how im executing... there's no secret, im just running an active scan... Right-button in the context and selecting active scan and my user 

[Nicollas Teixeira]

and... is there any way to use something like authentication tester on docker? or something similar

[Nicollas Teixeira]

and I don't know if it's normal but there are only requests in the GET method, the only POST request is the login request

[Nicollas Teixeira]

hey, any news about?

[Simon Bennetts]

Run an active scan as you are doing right now, but deselect 'Recurse" - we want to limit what ZAP is doing.

Look in the Output tab - anything in there?

Look at the first requests ZAP sends - does it look like its sending the right session tokens?