search

zaproxy / zap-hud

The ZAP Heads Up Display (HUD)
Apache License 2.0
250 stars 151 forks source link

The HUD fails to connect to ws endpoints from a domain upgraded to https #525

Closed halfluke closed 5 years ago

halfluke commented 5 years ago

Any website, even one that should be available in plain http, is automatically redirected to https when the Extensionhud extension is enabled. This did not happen in version 2.7.0 and it causes problem with websockets which work on http

Steps to reproduce the behavior:

  1. Open firefox.
  2. Configure it to use zap proxy
  3. Go to any website available in http (I won't mention a specific one here)
  4. The browser is redirected to https (although the request in zap is logged as an http request)

Expected behavior The website should be reachable in http (in my test, the https website is different and someway broken, the original website is intended to be reachable on http and not redirected to https)

Software versions

psiinon commented 5 years ago

@halfluke simple solution - disable the HUD :) The HUD has to upgrade http -> https or it cant work. However it sounds like theres a bug in the ZAP is not handling the websockets correctly. Can you explain how websockets is used in your application? Exactly how is it failing? Transferring to zap-hud...

halfluke commented 5 years ago

ah thanks.

Actually I was playing with damn vulnerable websockets, docker version

you start it with docker run -d -p 80:80 -p 8080:8080 tssoffsec/dvws you have to put dvws.local in the host file (otherwise websockets do not work) When finally I had everything working, kali updated ZAP to 2.8.0 and it stopped working again. (I configured ZAP with port 8081 as a proxy listener)

What happens is that when dvws.local is redirected to https://dvws.local, all requests that use websockets simply do not go through. Not sure if it's relevant, if it's a zap issue or a dvws issue.

psiinon commented 5 years ago

@halfluke thanks - having an example failure case makes this much easier to look into :)

dscrobonia commented 5 years ago

Thanks for the clean report @halfluke ! Hopefully we can debug that one. We're also tracking the need to add documentation about this proces in #439 !

JavanXD commented 5 years ago
grafik

I have the same problem running the owasp juice shop as docker container. Juice Shop is not accessible over https but zap is redirecting the page to https (Location: https...). This is why you can see a blank page on the left.

psiinon commented 5 years ago

@JavanXD Thats strange, I've used the HUD against Juice Shop running in Docker many times without any problems. The fact that JS is not accessible via https is a red herring - ZAP handles the http->https upgrade internally where necessary. Are there any errors logged in the browser console?

JavanXD commented 5 years ago

After trying a few things, I was able to spot the problem. The JavaScript Files and the Stylesheets haven't been loaded correctly over HTTPS. Because I disabled to proxy them in:

image

Since the scripts cannot be loaded, the page is blank.

Example main.js:

image

@psiinon I do not know how best to solve it. Because ZAP does influence these requests by loading the page via HTTPS, but can then no longer take care of an HTTPS => HTTP downgrade (since the file types were excluded).

psiinon commented 5 years ago

@JavanXD #531will hopefully fix that problem, as long as you dont disable proxying for them :) Are you able to try that out?

psiinon commented 5 years ago

Re the original problem with dvwa this is still a problem - it fails with a security error trying to access ws://dvws.local:8080/ We'll probably need to rewrite the ws:// -> wss:// and handle the ws -> wss upgrade as well...

psiinon commented 5 years ago

Changed the title to make it more specific and we'll aim to fix this in the next version

JavanXD commented 5 years ago

I never had a problem with ws and as long i don't disable proxying it works well. In my case it was just wrong configuration.

psiinon commented 5 years ago

In the case of dvws it is a bug, but I have a (not too nasty) fix for it. I'll add a pref for it as well in case it break other cases.

halfluke commented 5 years ago

hi, so have you figured out if it's a problem with zap (hud) or with the dvws app? I'm following the discussion but I'm not sure I understand. You mentioned that the upgrade from http to https is handled internally by zap, but if a website cannot handle https, it won't be displayed. Do we still have to disable the HUD as you said in your first reply? Sorry about my confusion

thc202 commented 5 years ago

It's a problem with the HUD. Disabling the HUD was just a workaround, once this is fixed dvws will work properly with the HUD enabled.

halfluke commented 5 years ago

ah ok thanks. So are they actually 2 related but different issues? One is the http to https upgrade and one is the ws to wss upgrade?

thc202 commented 5 years ago

There's only one (afaik), the ws to wss upgrade (http to https should be working fine).