search

Grunny / zap-cli

A simple tool for interacting with OWASP ZAP from the commandline.
MIT License
229 stars 70 forks source link

Scanning of POST requests #73

Open lmtc668800 opened 5 years ago

lmtc668800 commented 5 years ago

Hello!

I'm trying use zap-cli to scan our application and I succeed to do it on URL which using GET method. However, I met a problem on scanning POST request, since the parameters were not included in the URL, and what I want to check is whether there is any security in those parameters. (In GUI the parameters are also recorded in the tree so that active-scan works)

May I know whether there is anyway to deal with POST requests?

gnirlos commented 4 years ago

Any update? How does one send POST commands from zap-cli?

hahwul commented 2 years ago

It's possible in an expedient way, so I'll share it 😊

1) Boot ZAP 2) Call this API for change attack mode

/JSON/core/action/setMode/?mode=attack

3) Include POST URL in sitetree 4) run quick-scan! now, when quick-scan is performed, the result of POST has already been scanned in attack mode and the result appears together.