I am running a python Zap script as follows:
zap = ZAPv2(proxies={'http': 'http://127.0.0.1:8119', 'https': 'http://127.0.0.1:8119'})
base_url = 'http://10.122.81.161/webui/#/dashboard/'
auth_url = 'http://10.122.81.161/webui'
auth_data = 'username%3D%7B%25username%25%7D%26password%3D%7B%25password%25%7D'
username = 'user'
password = 'pass'
new_context = randint(1, 100000000000)
context_id = zap.context.new_context(new_context)
auth_method_name = 'formBasedAuthentication'
authmethod_configparams = 'loginUrl=%s&loginRequestData=%s' \
% (auth_url, auth_data)
authcred_configparams = 'username=%s&password=%s' % (username, password)
zap.authentication.set_logged_in_indicator(context_id, loggedinindicatorregex='Welcome')
user_id = zap.users.new_user(contextid=context_id, name=username)
zap.users.set_authentication_credentials(
contextid=context_id,
userid=user_id,
authcredentialsconfigparams=authcred_configparams)
zap.users.set_user_enabled(contextid=context_id, userid=user_id, enabled=True)
zap.forcedUser.set_forced_user(context_id, user_id)
zap.forcedUser.set_forced_user_mode_enabled('true')
spider = zap.spider.scan_as_user(url=base_url, contextid=context_id, userid=user_id,
recurse='false')
It definitely appears that the scan is not run as an authenticated user because I get the same results whether I use correct or incorrect login credentials. In both cases, the URLs I get are in this format:
"http://10.122.81.161/webui/login?Password=ZAP&Username=ZAP%22%26timeout+%2FT+15%26%22",
"http://10.122.81.161/webui/webui/login/login?query=query%26sleep+15%26",
"http://10.122.81.161/webui/webui/login/login/assets/styles?query=query%3Bstart-sleep+-s+15+%23",
"http://10.122.81.161/webui/webui/login/login/assets/styles/login/assets/images/companylogo.png?query=query%3Bstart-sleep+-,
which tells me that Zap cannot get past the login page. What am I missing or what am I doing wrong? Thanks much.
Run ZAP with the GUI and run your script against it.
The follow the steps in https://github.com/zaproxy/zaproxy/wiki/FAQformauth#diagnosing-problems: