8

I have built a Managed Package that talks to an external REST API using OAuth2 Named Credentials. I now want to submit this app for Security Review. I can't use the Chimera Scanner as it would require someone to place this Abuse Token at the root of the endpoint server. I can't do that. So I try to make it work with OWASP ZAP instead but I couldn't find an understandable tutorial on how to make that work in ZAP.

I have no clue on how to put that into ZAP to finally and successfully click on "Attack".

Improve this question

2 Answers 2

Reset to default
12

For Finding vulnerabilities in the API only application(does not have a web app and you have access to only its REST API), you can configure proxies in the Postman and execute OAuth and other REST api invocations and network requests goes through same proxy that ZAP is configured to intercept.

If You have web app you can configure your browser as proxy so that any URL you browse through goes through a proxy server which ZAP can intercept.

Steps

Generate a root certificate in zap to import into the browser/Postman(if you are testing an api). Go to Tools > Options > Dynamic SSL Certificates and save this locally.

enter image description here

Import the certificate to the browser/Postman(I suggest you use another browser solely for this than one you currently use for general purpose. Makes it easier that you do not mess with your current config. I usually prefer Mozilla for this as i use chrome for general purpose)

For firefox go to about:preferences url and select Privacy and Security and choose certificates

Go to Authorities to import the certificate you have saved in step 1

enter image description here

If you are testing for api only and does not have a web app and you use Postman to make a request , save your certificate in Postman using preferences tab as shown below

enter image description here

  • Configure your browser proxy url as shown below. You can go to Network Settings in your browser to do this using about:preferences.

enter image description here

  • Configure the Local Proxy in ZAP tool using Tools > Options > Local Proxy

enter image description here

Now any URL you browse will be recorded with complete hierarchy. This appears under the Sites as shown here

enter image description here

If your app is an API only then configure proxy in Postman.

Use postman to make request and it will record the URL for the attack. For OAuth 2.0 go through the Authentication using the Postman configuration.

One important thing to verify here is to make sure Postman uses a same proxy as that of the zap tool.

You can configure in preferences as explained in below article

https://learning.postman.com/docs/postman/sending-api-requests/proxy/

enter image description here

If you further need to customize one can use authentication scripts in ZAP (You generally do not need this until you have a complex authentication or want to test with specific headers) and ZAP has community scripts that covers some sample use cases and scripts here

Finally to scan or Spider attack the URL all you need to do is right click and execute the Attack as shown in below image

enter image description here

Use the reports tab to generate the ZAP Report that you can submit to Sec review team.

enter image description here

Additional Resources

ZAP configuration tutorial from salesforce security help is here and steps to configure documented is here

Note that ZAP is free and flexible and to customize you can read the docs

Also ZAP has video tutorials here

Improve this answer
9
  • Your answer only covers the scanning of browsable web apps using a browser proxy. That's not what I want. I need to scan an OAuth2 secured REST API endpoint. 😐
    – Robert Sösemann
    Commented Jul 3, 2020 at 14:06
  • Please use postman as mentioned there to execute your rest call and it will all be recorded and then you can attack. I have adopted this technique in the past and it works! Also i have mentioned if it gets complex you have to script it as per the need!
    – Mohith Shrivastava
    Commented Jul 3, 2020 at 14:09
  • 1
    It worked and I will make yours the selected answer but I kindly ask you to remove the irrelevant information. Instead of showing how to proxy firefox show all the steps needed to Set Certificare and Proxy inside Postman. Then the answer is helpful to others.
    – Robert Sösemann
    Commented Jul 3, 2020 at 14:55
  • 1
    I think it’s ok to keep and enhance it. I will work on it once I am on the computer to refine it better! The answer can be general purpose here!
    – Mohith Shrivastava
    Commented Jul 3, 2020 at 14:56
  • 1
    @robert feel free to share and accept your own answer:) I am off the computer for sometime! Glad I was able to help you
    – Mohith Shrivastava
    Commented Jul 3, 2020 at 15:14
4

If the accepted answer is too detailed for you, here is a short summary of what was important for me:

Steps I have taken:

  1. Create and save self-signed Certificate from ZAP
  2. Add Certificate to Postman
  3. Set Postman to go through localhost Proxy
  4. Turn off Postman setting to not use Self-signed certificates
  5. Create or Import a Postman collection for the external API
  6. OAuth-authenticate (or any other mechanism) from Postman
  7. ZAP should now record all those calls
  8. In ZAP run a Spider scan on API root endpoint
  9. Save HTML Report in ZAP and check for issues.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .