NTLM authentication in ZAP

Viewed 2720

I'm trying to do some penetration testing of REST Api using ZAP. Api uses windows authentication [domain\username] and is hosted locally on a specific port. First I did a test using postman to try to connect and make an example request. My config looked like this:

enter image description here

I decided to replicate this setup in OWASP zap. I set up my user:

enter image description here

then I set up authentication options in session properties:

enter image description here

and session management options:

enter image description here

I get Unauthorized and BadRequest responses when tryng to perform Active Scan in ZAP. I tried different user names and ports but it seems that there is some small piece missing in my config. I came across a link on their github page:

HTTP/1.1 401 Unauthorized

but it didn't solve my problem.

How should I set up ZAP to use NTLM authentication? I'm suprised that I was able to set this up in Postman in 5 minutes, but in ZAP it took me two days already and still nothing.

Oh, and not to mention that in C# code it was also 10 minutes of work using default credentials injected into httpclient through httpclienthandler class:

ICredentials credentials = CredentialCache.DefaultCredentials;
var clientHandler = new HttpClientHandler()
{
    Credentials = credentials
};

var client = new HttpClient(clientHandler);
var resp = client.GetAsync(new Uri(apiUrl)).Result;

Any help appreciated. Thank you

1 Answers

Was stuck in same issue, Thank God, it got resolved after 4 days of effort just to find a small setting.

Just make sure to Enable: Forced User Mode Not sure why I need to select this, even when I have selected only one user in authentication that too enabled. But this also makes sense, but it should be mentioned as information in authentication popup, to help beginner like me.

enter image description here

Related