search

iriusrisk / bdd-security

BDD Automated Security Tests for Web Applications
http://www.continuumsecurity.net/bdd-intro.html
GNU Affero General Public License v3.0
563 stars 178 forks source link

OWASP ZAP Details/Session info #59

Open kenmasters1 opened 7 years ago

kenmasters1 commented 7 years ago

Hello,

I have an application where the "passive scan" via OWASP ZAP has identified a potential issue.

However, none of the reports (Cucumber, build/zap/passive.xml, etc.) have details that show what the payload was in the request, and what the response body was.

E.g. from passive.xml: 

<alertitem>
  <pluginid>10023</pluginid>
  <alert>Information Disclosure - Debug Error Messages</alert>
  <name>Information Disclosure - Debug Error Messages</name>
  <riskcode>1</riskcode>
  <confidence>2</confidence>
  <riskdesc>Low (Medium)</riskdesc>
  <desc>&lt;p&gt;The response appeared to contain common error messages returned by platforms such as ASP.NET, and Web-servers such as IIS and Apache. You can configure the list of common debug messages.&lt;/p&gt;</desc>
  <instances>
  <instance>
  <uri>https://domain/page.html</uri>
  <evidence>Internal server error</evidence>
  </instance>
</alertitem>

I took a quick look at the ZAP API and didn't see an option to enable saving the session.

I see there is a zap/tmp/session folder that has some data files, but no ".session" files that ZAP would use to open via the GUI. I tried opening the ".data" file and the creating a mock ".session" file, but ZAP was complained about errors in both cases.

What are our options?

Thanks!