intruxxer / zaproxy

Automatically exported from code.google.com/p/zaproxy
0 stars 0 forks source link

Selecting an item in the Sites Tree should show the latest request/response #645

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
In order to facilitate setting context login/logout info it would be nice/best 
if selecting an item in the site tree displayed the latest request/response for 
the resource in question.

The reason I'm suggesting this is that I was setting up a context and login 
details when I accidentally locked the account I was trying to setup.

I could not then override the POST information associated with the login 
details as ZAP kept wanting to use the info from the original request.

Original issue reported on code.google.com by kingtho...@gmail.com on 18 Apr 2013 at 3:47

GoogleCodeExporter commented 9 years ago
Except for some "special" cases the message shown is the latest message (maybe 
you're encountering one of those cases).

Can you, consistently, reproduce the issue? if so, would you mind tell the 
required steps? (the response status code of the message(s) is important)

P.S. Note that you can manually change the login POST data.

Original comment by THC...@gmail.com on 22 Apr 2013 at 3:13

GoogleCodeExporter commented 9 years ago
Hi THC, I'll play with it a bit more today and see if I can consistently 
reproduce.

I'm starting to think that I'm trying to get ZAP to do something it just isn't 
yet ready for. The login requires multiple token tracking, and the tokens 
aren't set properly if you just try doing the login straight from the login 
form action, etc.

Original comment by kingtho...@gmail.com on 25 Apr 2013 at 1:14

GoogleCodeExporter commented 9 years ago
Yes, the current ZAP authentication mechanims wont handle complex / multiple 
forms, just simple ones.

Zest, on the other hand, may well be able to cope :)
http://code.google.com/p/zap-extensions/wiki/AddOn_Zest
It might be worth downloading the add-on and having a play - its not fully 
integrated with ZAP yet - hopefully we'll have a GSoC project which addresses 
that.

Original comment by psii...@gmail.com on 25 Apr 2013 at 1:57

GoogleCodeExporter commented 9 years ago
Good news. I did some more work with ZAP this morning and it does indeed seem 
to be showing the latest request/response (not sure how I broke it the other 
day).

Thanks for letting me know about Zest, I'll try it out.

You can go ahead and close this ticket. If I encounter this issue again I'll 
try to dig further and if I can re-create then I'll open a new ticket.

Original comment by kingtho...@gmail.com on 25 Apr 2013 at 2:56

GoogleCodeExporter commented 9 years ago
Thanks - please let us know how you get on and do raise another ticket if you 
can recreate it.

Original comment by psii...@gmail.com on 25 Apr 2013 at 2:57

GoogleCodeExporter commented 9 years ago
How do I get permission to edit the wiki?

I just went to checkout Zest and immediately noticed a few minor typos. I'd be 
glad to fix these types of things when I notice them.

Original comment by kingtho...@gmail.com on 25 Apr 2013 at 2:57

GoogleCodeExporter commented 9 years ago
I'm sure there are many :)
Which wiki?
The github one or the Mozilla one?
The latter you can just sign up for, the github one I'm not actually sure, I'll 
have to look into that ;)

Original comment by psii...@gmail.com on 25 Apr 2013 at 2:59

GoogleCodeExporter commented 9 years ago
I _think_ you should already be able to edit the Zest wiki on github - can you 
have a try?
You'll probably need a a github user...

Original comment by psii...@gmail.com on 25 Apr 2013 at 4:17

GoogleCodeExporter commented 9 years ago
I meant the google code wiki.

http://code.google.com/p/zap-extensions/wiki/AddOn_Zest

Original comment by kingtho...@gmail.com on 25 Apr 2013 at 4:39

GoogleCodeExporter commented 9 years ago
Ah, I can do that :)
Hopefully you can edit it now...

Original comment by psii...@gmail.com on 25 Apr 2013 at 4:46

GoogleCodeExporter commented 9 years ago
Thanks!

Original comment by kingtho...@gmail.com on 25 Apr 2013 at 4:55