Header Based Authentication in Owasp zap

user_4876273 0
Viewed 1453

I am trying to implement Owasp Zap scan. But I am unable to find script for header authentication

How to add header authentication for the key value pair e.g key =api-key value = 123

    docker run --rm -v $(Agent.ReleaseDirectory)/docker:/zap/wrk/:rw -t ictu/zap2docker-weekly zap- 
     baseline.py \
      -t https://www.example.com/ProductDetails/v1/details?productId=123456 \
      -I -x governreport.xml \
       -r testreport.html \
      --hook=/zap/auth_hook.py \ 
        -z "auth.loginurl=https://www.example.com/ProductDetails/v1/details?productId=123456" \

I am following this article:

azure-pipelines-release-pipeline zap owasp docker security
1 Answers

To add the header you want you can include the following options in your -z

  -config replacer.full_list\\(0\\).description=auth1 \  
  -config replacer.full_list\\(0\\).enabled=true \  
  -config replacer.full_list\\(0\\).matchtype=REQ_HEADER \  
  -config replacer.full_list\\(0\\).matchstr=Authorization \  
  -config replacer.full_list\\(0\\).regex=false \  
  -config replacer.full_list\\(0\\).replacement=123456789

So your command would look something like

    docker run --rm -v $(Agent.ReleaseDirectory)/docker:/zap/wrk/:rw -t ictu/zap2docker-weekly zap- 
 baseline.py \
  -t https://www.example.com/ProductDetails/v1/details?productId=123456 \
  -I -x governreport.xml \
   -r testreport.html \
  --hook=/zap/auth_hook.py \ 
    -z "auth.loginurl=https://www.example.com/ProductDetails/v1/details?productId=123456" \
  -config replacer.full_list\\(0\\).description=auth1 \  
  -config replacer.full_list\\(0\\).enabled=true \  
  -config replacer.full_list\\(0\\).matchtype=REQ_HEADER \  
  -config replacer.full_list\\(0\\).matchstr=api-key \  
  -config replacer.full_list\\(0\\).regex=false \  
  -config replacer.full_list\\(0\\).replacement=123

With this you will have the header api-key: 123 added to all of your requests.

Reference: https://www.zaproxy.org/blog/2017-06-19-scanning-apis-with-zap/

user_84404770
Related