USING WEB PROXIES ZAP Scanner

HTB Content Academy
29

for future readers.

you probably ran spider scan then ajax spider scan, if you didn’t… do that .
then run active scan with

recurse mode on
, and on the same site and port and it will run for a while then it will show you a certain high alert that was already shown inside the module. copy that payload and modify it for flag.txt.

I guess I didn’t add a single word that destroys the try harder solution hopefully

but please see why the HUD doesn’t work for you and try to make it work, it is a must coupled with burp suite community.

30

I’ve worked with ZAP before, and for quick vulnerabilities, you might want to focus on things like open redirects or weak HTTP headers (like missing security headers). These are pretty common and don’t usually require a ton of work to identify. Try checking for misconfigurations in the proxy setup too.