1239763 - [security] ZAP - investigate REST API URL list definition

Status: RESOLVED WONTFIX

(Cloud Services :: QA: Test Automation, defect)

Description

[Richard Pappalardo [:rpapa][:rpappalardo]]

from :psiinon

We have an add-on which will import lists of plain URLS in text files - one per line.
This works well with web apps as we can then spider those URLs.
It wont work so well with APIs because we wont know what data to supply, and thats always the most useful stuff to attack;)

If you do have some data then how about defining it in something like swagger / openapis or WADL?
OK, so we cant import those yet ... but we've got an open issue to do so and it will be a great incentive for me to fix that, even if its a quick hack ;)

Comment 1

[Richard Pappalardo [:rpapa][:rpappalardo]]

we're going to use http_proxy instead