kasunkv / owasp-zap-vsts-task

Visual Studio Team Services build/release task for running OWASP ZAP automated security tests
MIT License
30 stars 11 forks source link

How can I authenticate into the application used this extension #53

Open Joshwa15 opened 4 years ago

Joshwa15 commented 4 years ago

Please Let me know How to do authenticated scans used this plugin.

eL-Prova commented 3 years ago

Take a look at my repo for authentication scripts. With these steps you can make it work

CurlyBytes commented 3 years ago

@eL-Prova i did review your repo, i didn't quite to make it work out, do you have blogs or instruction aside from the readme file? thanks

amolcg commented 3 years ago

@cocoytech @eL-Prova for me its does not work, do you have some readme file, it would be helpful

eL-Prova commented 3 years ago

@eL-Prova i did review your repo, i didn't quite to make it work out, do you have blogs or instruction aside from the readme file? thanks

Hey @cocoytech, what have you tried? I need a little bit more information about your environment. I will upload my steps in my pipeline to my repo. Maybe that can make a little bit more clear how it works.

@amolcg for you the same questions, what have you tried?

amolcg commented 3 years ago

@cocoytech Approch currently i am trying

  1. Create context with all details, i am testing with Form Based method e.g http://demo.testfire.net/login.jsp
  2. Export context
  3. Power shell, import context ( i have hosted zap on reverse proxy to access api)
  4. Power shell to set ForceUser unable
  5. Start Spider using powershell.
  6. VSTS task, set only Active scan ( currently i am testing , hoping for best) -- uncheck zap session checkbox
  7. Removed context at last from zap
CurlyBytes commented 3 years ago

@eL-Prova Thank you for your attention and Time @amolcg , thanks for the format now I have something in my mind how to define the environment and steps, I'm currently just using GUI for this troubleshooting, I did file the actual setup here from the issue of the actual repo itself