OWASP ZAP Advanced Proxy Features

Advanced proxy configuration, interception, manipulation, and traffic analysis techniques in OWASP ZAP

Advanced Proxy Features in OWASP ZAP

OWASP ZAP's proxy is one of its most powerful components, offering far more than basic request interception. This guide explores advanced proxy features that can significantly enhance your security testing capabilities.

Proxy Configuration

Network Configuration

Configure advanced network settings:

  1. Local Proxies:

    • Configure multiple listening interfaces
    • Set up different ports for different applications
    • Enable IPv6 support
    • Configure connection timeouts
  2. Connection Settings:

    • Configure DNS resolution
    • Set up connection timeouts
    • Configure socket permissions
    • Enable/disable HTTP/2 support

Request and Response Interception

1
Break Points Configuration

Configure advanced break points:

  1. Configure conditional break points:

    • Break on specific URLs or patterns
    • Break on specific HTTP methods
    • Break on request/response headers
    • Break on request/response body content
  2. Set up break point rules:

    • Create complex break point conditions
    • Combine multiple conditions
    • Configure break point scope
    • Set up break point timing
2
Request Manipulation

Advanced request manipulation:

  1. Modify request components:

    • Edit headers on-the-fly
    • Manipulate cookies
    • Modify request body content
    • Change HTTP methods
  2. Use specialized editors:

    • Structured editors for JSON/XML
    • Hex editor for binary content
    • Syntax highlighting for various formats
    • Format validation and beautification
3
Response Manipulation

Advanced response manipulation:

  1. Modify response components:

    • Edit status codes
    • Manipulate response headers
    • Modify response body content
    • Change content encoding
  2. Use specialized techniques:

    • Inject JavaScript into HTML responses
    • Modify JSON/XML structures
    • Manipulate binary responses
    • Handle compressed content

Traffic Manipulation

Replacer

The Replacer add-on allows automatic content replacement:

  1. Configuration:

    • Set up match and replacement strings
    • Configure replacement scope
    • Define replacement triggers
    • Set up replacement rules priority
  2. Advanced Use Cases:

    • Replace authentication tokens
    • Modify security headers
    • Inject tracking parameters
    • Remove security controls for testing
    • Automate repetitive modifications

Example replacer rule to add a security header:

  • Match Type: Response Header
  • Match String: (Leave empty to add a new header)
  • Replacement: Content-Security-Policy: default-src 'self'
  • Enable: Checked
  • Match Type: Regex
  • Description: Add CSP header

Advanced Traffic Analysis

1
Traffic Filtering

Configure advanced traffic filtering:

  1. Set up filter criteria:

    • Filter by request/response size
    • Filter by status code
    • Filter by content type
    • Filter by request method
    • Filter by response time
  2. Create complex filters:

    • Combine multiple filter conditions
    • Use regular expressions for filtering
    • Save and reuse filter configurations
    • Export filtered results
2
Traffic Analysis

Advanced traffic analysis techniques:

  1. Analyze traffic patterns:

    • Identify request sequences
    • Detect authentication flows
    • Map application functionality
    • Discover hidden endpoints
  2. Use specialized analysis:

    • Compare requests and responses
    • Analyze parameter usage
    • Detect information leakage
    • Identify security patterns
3
Traffic Visualization

Visualize traffic for better understanding:

  1. Use built-in visualization:

    • View site structure
    • Analyze request/response sizes
    • Track response times
    • Visualize request relationships
  2. Export for external analysis:

    • Export to HAR format
    • Generate traffic reports
    • Create custom visualizations
    • Integrate with external tools

WebSockets

WebSocket Interception

Intercept and analyze WebSocket connections:

  1. Connection Handling:

    • View active WebSocket connections
    • Track connection establishment
    • Monitor connection status
    • Handle secure WebSocket connections
  2. Message Interception:

    • Configure break points for WebSocket messages
    • Set up conditional breaks
    • View message metadata
    • Track message sequence

HTTP/2 and HTTP/3 Support

1
HTTP/2 Configuration

Configure HTTP/2 support:

  1. Enable HTTP/2 support:

    • Go to Tools > Options > Network
    • Enable HTTP/2 support
    • Configure HTTP/2 settings
  2. HTTP/2-specific features:

    • View HTTP/2 streams
    • Analyze HTTP/2 headers
    • Test for HTTP/2-specific vulnerabilities
    • Handle HTTP/2 server push
2
HTTP/3 Support

Work with HTTP/3 (QUIC):

  1. Configure HTTP/3 support:

    • Install required add-ons
    • Configure HTTP/3 settings
    • Set up QUIC parameters
  2. HTTP/3-specific testing:

    • Test for HTTP/3 compatibility
    • Analyze QUIC connections
    • Identify HTTP/3-specific security issues
    • Compare behavior across HTTP versions
3
Protocol Comparison

Compare behavior across protocol versions:

  1. Test application with different protocols:

    • Force specific HTTP versions
    • Compare performance characteristics
    • Identify version-specific vulnerabilities
    • Test protocol downgrade scenarios
  2. Security implications:

    • Analyze header handling differences
    • Test for protocol-specific vulnerabilities
    • Check for inconsistent security controls
    • Verify proper protocol negotiation

Mobile Application Testing

Mobile Proxy Setup

Configure ZAP for mobile application testing:

  1. Network Configuration:

    • Configure proxy to listen on all interfaces
    • Set up appropriate port forwarding
    • Configure mobile device network settings
    • Test connectivity between mobile and ZAP
  2. Platform-Specific Setup:

    • Configure iOS proxy settings
    • Set up Android proxy configuration
    • Handle emulator/simulator proxy settings
    • Configure VPN-based proxying

Proxy Extensions and Add-ons

1
Essential Proxy Add-ons

Key add-ons for enhanced proxy functionality:

  1. Replacer:

    • Automatically replace content in requests and responses
    • Configure match and replacement rules
    • Apply conditional replacements
  2. Advanced Proxy Settings:

    • Configure additional proxy options
    • Set up specialized proxy behaviors
    • Customize proxy response handling
  3. WebSockets:

    • Intercept and manipulate WebSocket connections
    • Analyze WebSocket traffic
    • Test WebSocket security
2
Custom Proxy Scripts

Create custom proxy scripts:

  1. Script types:

    • HTTP Sender scripts
    • Proxy scripts
    • Targeted scripts
  2. Script capabilities:

    • Modify requests and responses
    • Implement custom logic
    • Integrate with external tools
    • Automate complex workflows

Example proxy script for request modification:

// Add a timestamp header to all requests
function proxyRequest(msg) {
    var header = "X-Request-Timestamp";
    var timestamp = new Date().toISOString();
    msg.getRequestHeader().setHeader(header, timestamp);
    return true;
}

function proxyResponse(msg) {
    // Process responses if needed
    return true;
}
3
External Tool Integration

Integrate with external tools:

  1. Forward proxy traffic:

    • Configure ZAP as upstream proxy
    • Forward specific traffic to external tools
    • Chain multiple security tools
  2. API integration:

    • Use ZAP API to control proxy behavior
    • Integrate with custom tools
    • Automate proxy configuration
    • Implement custom proxy workflows

Case Studies and Examples

API Testing with Advanced Proxy

  1. Scenario: Testing a REST API with JWT authentication

  2. Approach:

    • Configure proxy to intercept API requests
    • Use Replacer to automatically add authentication headers
    • Create custom scripts to validate and modify JWT tokens
    • Set up break points for specific API endpoints
    • Use WebSockets for real-time API testing
  3. Results:

    • Identified authentication bypass vulnerabilities
    • Discovered insecure JWT implementation
    • Found authorization flaws in API endpoints
    • Detected information leakage in error responses

Next Steps

Now that you understand advanced proxy features in OWASP ZAP, explore these related topics: