1.2.1. UserInterface

1.2.1 UserInterface

1.2.1.1 Main Panel in ZAPROXY's workpanel

• 1)Selected HTTP Request
  In the [RecordedRequestList] pane, You can select [Http Request] and perform operations such as view/edit/sendmsg/scan actions as described in the following items.

• 2)RequestList Popups
  [DisableRequest]: If you set the request to be disabled, the request will be ignored(no sending) during zaproxy scans or sendmsg.

[EnableRequest]: You can enable disabled request.

[Delete]: Delete the selected request if unnecessary.

[Scan..]: Execute ActiveScan for the selected request.

[Sendmsg]: Execute Sendmsg(Resend Request) for the selected request.

• 3)RequestEdit Popups
  [Edit]: Popup MessageEditor for Editing selected Http Request in the RecordedRequestList.(See below:MessageEditor)
  [Restore]: Restore(Rollback) edited Http Request to Original.
  [Update]: Update(Save) edited Http Request to Original.
  [Scan..]: Execute ActiveScan for the selected request.
  [Sendmsg]: Execute Sendmsg(Resend Request) for the selected request.

• 4)Main Buttons
  [Track]: create tracking parameter for CSRF tokens/cookies from request/response list automatically.
  [Custom]: setting tracking parameter manually.
  [Clear]: clear all (including requests/tracking parameters).
  [Load]: load saved parameter from json file.
  [Save]: save parameter to file.
  [▲UP]: move up selected request in Request List.
  [▼DOWN]: move down selected request in Request List.

• 5)Initialize Cookie/Tracking Parameter value from cache at start
  Enabled: Cookie/CRSF token value get from cache which value is set on previously executed.
  Disabled: Cookie/CSRF token value is initialized.

• 6)Tracking Parameter
  replace: CSRF tokens/Cookies values are wholely replaced by automacrobuilder.
  baseline(experimental): CSRF tokens/Cookies are partially replaced by RequestRecorder. you can test(attack) these parameter values.

• 7)Pass back to the invoking tool
  Enabled: when scanning, selected request's response is overwrited by last request's response in RecordedRequestList.
  Disabled: The above actions do nothing.

• 8)Other Options
  Usually, you do not need change options.
  [WaitTimer(sec)]: If the checkbox flag is checked, wait for the next request to be sent for the specified number of seconds.
  [Track Parameter Value From Specific Response]: if this value set on checkbox, when Track button push, then generate CSRF parameter for tracking with specific Request List number.
  [Track Parameter value set to Specific Request]: if this value set on checkbox, when Track button push, then generate CSRF parameter for tracking with specific Request List number.

1.2.1.2 MessageEditor

• 1)MessageEditor Popups
  [Undo]: Undo Editing
  [Redo]: Redo Editing
  [Insert CR]: Insert CR(0x0d) into current caret.

• 2)Hex Editor
  Display Hexadecimal Editor for the HttpMessage.

• 3)Save
  Save Edited Message and close MessageEditor.

• 4)Cancel Discard Changes and close MessageEditor

Next