mardi 2 octobre 2018

OWASP ZAP : How to perform authentication when API endpoint only accepts raw XML?

I'm currently working at testing an Angular 6 application using OWASP ZAP. I really enjoy this tool, but like many of us, I struggle with the authentication part, and without it the whole tool turns into a nothing burger.

The login route is accessible on my localhost at /login and my API endpoint https://api.mytestproject.com/auth only accepts raw XML such as:

<EngineDocList>
  <DocVersion>1.0</DocVersion>
  <EngineDoc>
    ...
    <User>
      <Username>testuser</Username>
      <Password>test</Password>
      <CustomField DataType="S32">blablabla</CustomField>
    </User>
    ...
  </EngineDoc>
</EngineDocList>

I get a token in response, but the API requires it to be sent in the body as a field of each request rather than as an Authorization header.

Also, running the spider does not give me any time to login manually, and I can't really provide any string to tell if I'm logged in or logged out as my Angular app is not server rendered.

Any light is welcome, Thanks!

Aucun commentaire:

Enregistrer un commentaire