New answers tagged zap-scanner
0
If the accepted answer is too detailed for you, here is a short summary of what was important for me:
ZAP is the right tool. But forget everything you read on Google on how to make it directly talk to OAuth REST. Use a Proxy through Postman instead.
What works with Web App Proxies (described in detailed here) also works with Postman Proxies described here.
...
6
For Finding vulnerabilities in the API only application(does not have a web app and you have access to only its REST API), you can configure proxies in the Postman and execute OAuth and other REST api invocations and network requests goes through same proxy that ZAP is configured to intercept.
If You have web app you can configure your browser as proxy so ...
Top 50 recent answers are included
