Forum Discussion

Icon for Bronze II rank

Bronze II

11 days ago

Introduction to OWASP ZAP

I'm completely stuck with this one

I can see in the robots.txt that there's a disallow page as /checkout but it seems that this page doesn't exists.. What i'm missing? any hint?

application security

AtakanBal
10 days ago
So, your mistake is that you assume the "/checkout" page is the draft checkout page you are looking for but its not

In order to find the correct page, you are expected to perform a ZAP spider attack. Authentication configurations should be there because only then ZAP will be able to fully crawl the website. After that if you look at the resources ZAP finds carefully, the correct URL should be there

Regarding configuring the ZAP for this Briefing section should guide you

AtakanBal
Bronze III
11 days ago
To find the hidden checkout page you need to perform a spider attack with authentication settings in place
- PedroCollado
  Bronze II
  10 days ago
  Maybe I'm getting all this wrong, but I think that the problem is that the requested page does not exists at all
  Let me elaborate this a little bit more... in the lab tasks we have two pages to investigate:
  /useful_admin_stuff
  /chekout
  You suggests that this is a problem of authentication, in this case I would get a 302 or 308, like is happening with the /useful_admin_stuff, where I can circumvent once the authentication is solved
  
  But for /checkout
  I'm just getting a 404 error like if the page doesn't exists
  
  So? Is still something that I'm doing wrong or is the lab missing a page that should be there?
  - AtakanBal
    Bronze III
    10 days ago
    So, your mistake is that you assume the "/checkout" page is the draft checkout page you are looking for but its not
    
    In order to find the correct page, you are expected to perform a ZAP spider attack. Authentication configurations should be there because only then ZAP will be able to fully crawl the website. After that if you look at the resources ZAP finds carefully, the correct URL should be there
    
    Regarding configuring the ZAP for this Briefing section should guide you