OWASP ZAP 身份验证 - 无法使用 zap/zap 阻止它

Question

I can't get zap past the login page. It just fixates on the login and forgotten password forms.

I have followed various official HOWTOs and this FAQ but even though I have deleted the zap user, it still uses login_id=ZAP&password=ZAP when trying to log in.

I'm in standard mode, forced user mode, forced user is defined, logged in and logged out strings are defined - and I have tried others.

login form target url: https://xxx.yyy.net/affiliate_login_action.ido

login request POST data: login_id={%username%}&password={%password%}

logged in regex: \\QLogout\\E

logged out regex: \\QAgent Login\\E

I can't think what else to try.

Answer 1

The regexs doesn't seem right. In my experience when you don't specify correct login/logout regexs ZAP is using just ZAP , ZAP .

Try to change regexs to .*\\QLogout\\E.* and .*\\QAgent Login\\E.*