ICTU / zap2docker-auth-weekly

Zap baseline scanner in Docker with authentication
Apache License 2.0
104 stars 70 forks source link

Zap docker scan with authentication not working #63

Closed Vijay1216 closed 11 months ago

Vijay1216 commented 1 year ago

I tried this docker run --rm -v $(pwd):/zap/wrk/:rw -t ictu/zap2docker-weekly zap-baseline.py -I -j \ -t https://target.com/ \ -r test-report.html \ --hook=/zap/auth_hook.py \ -z "auth.loginurl=https://target.com/login \ auth.username="test" \ auth.password='test123'"

But it's not authenticating the url target.com/login

rafalmeisel commented 1 year ago

Hello @Vijay1216 ! Thank you for your ticket!

Ask to you:

  1. Could you please provide the logs from docker image run, please?
  2. Could you try to run the script with provided login_field, password_field and submit_field, please?
docker run --rm -v $(pwd):/zap/wrk/:rw -t ictu/zap2docker-weekly zap-baseline.py -I -j
  -t https://target.com \
  -r test-report.html \
  --hook=/zap/auth_hook.py \
  -z "auth.loginurl=https://target.com/login \
      auth.username="test" \
      auth.password="test123" \
      auth.username_field="j_username" \
      auth.password_field="j_password" \
      auth.submit_field="submit" \"

There could be many cases when authentication could not work (that's why, log from console is very helpful):

  1. User is not created on website
  2. Selenium could not find specific username field, password field, submit button,
  3. Submit button could be overlaid by other element.

Best regards, Rafał Meisel