Search code examples
securitytestingowaspzap

OWASP ZAP when using spider showing in Spider tab "OUT OF CONTEXT" with url "weburl/Site.css"

I am new to OWASP ZAP and started manually testing through contexts and using Session Properties.

But I cannot able to detect all logged in URLs of my huge website with the help of spider. Can anyone give me quick demo for how to detect all URLs through spider by using proxy setting through firefox.

enter image description here

Solution

  • Go to your local proxy options in Zaproxy and set them to an ip for example: ip: 127.0.0.1 port: 8090

    redirect your firefox settings to proxy through the ip and port that you set as a local proxy.

    surf with your firefox to your site. A map should appear in zaproxy with your website. right click the map and click add to context.

    Then attack that context with a spider, be sure to set your crawl dept high enough so it can find as many pages as possible. If you use authentication set it at the authentication tab in the settings of the context you added the website to. Otherwise the pages that require authentication will never be found.

    (i hope this is what you wanted, question is a little bit vague)