Closed GoogleCodeExporter closed 9 years ago
Did you also include [1] the target site in context? Otherwise ZAP will not try
to authenticate.
In "History" tab do you see any requests tagged with "Authentication" while
active scanning?
Active scan does not do brute-forcing, what might be happening is that the
login request is also being used to test for vulnerabilities.
Have you tried exclude [2] the login request from the scan?
[1]
https://code.google.com/p/zaproxy/wiki/HelpUiDialogsSessionContexts#Include_in_c
ontext
[2]
https://code.google.com/p/zaproxy/wiki/HelpUiDialogsSessionSessprop#Exclude_from
_scanner
Original comment by THC...@gmail.com
on 28 Apr 2015 at 10:19
Thank you for reply. Now It works!
I set the "include in context" and "exclude from scanner"
The problem was that in API you have to point out the forced user, which will
be use for authentication:
forcedUser.setForcedUser
forcedUser.setForcedUserModeEnabled
Original comment by sufferin...@gmail.com
on 28 Apr 2015 at 1:50
OK, thanks for letting us know.
Right, the active scan should allow to scan as an user like the spider API does.
Original comment by THC...@gmail.com
on 28 Apr 2015 at 3:11
Issue 1621 has been raised to allow to scan as an user, like the spider API
does.
Original comment by THC...@gmail.com
on 2 May 2015 at 3:33
Original issue reported on code.google.com by
sufferin...@gmail.com
on 28 Apr 2015 at 8:15