Search code examples
owaspzap

Read OTP from DataBase for OWASP ZAP authentication


We have an application we are testing for vulnerabilities using OWASP ZAP. To handle Login, I have created an authentication script for the UserName and PassWord, however, post submitting credentials, the application redirects to an OTP page. The OTP can be read from DataBase. Is there a way to read data from DBs using Owasp ZAP.


Solution

  • Yes. ZAP scripts can do anything you want - they have the same permissions as ZAP. So if you can access an OTP in any way from the command line then yes, ZAP scripts will be able to use it.