Search code examples
spring-bootowasppenetration-testingsecurity-testingcrlf-vulnerability

How can we do VAPT using OWASP ZAP in microservices?

I had gone through the OWASP ZAP and I found that ZAP requires endpoint of the web application. But still, I tried to provide URL of REST APIs of our microservices but I was getting 404 error. What I think is OWASP ZAP scans on HTTP GET method and don't allow POST method or else.

Below is the screenshot of ZAP: Link to the screenshot of ZAP

I know there is a post related to test of rest API but that post i was not full clear and was also not related to micro services. Please recommend any better open source software and way through which we can do our VAPT test easily.

Thanks

Solution

  • The ZAP Quick Start option only supports GET requests, but you can easily send POST requests using the Manual Request dialog. With APIs the main problem is how to discover them. Does that end point link to all of the other API end points?