How to do security testing on AngularJS with the use of OWASP ZAP

Question

I tried using OWASP in my angularjs web app, however.. none of my routing pages ever get lists in the spider.. can someone give me a detailed explanation on how to do this? I just want to see the vulnerabilites of all routing URLS in my angularjs app

Answer 1

ZAP will spider from the base URL you give it. Make sure that it can get to your routing pages by traversing the paths of available links that start on your base URL. If ZAP can't get to them by traversing your site from the base URL, create a simple sitemap or listing of all of your URLs and link/insert that on your home page.

Also, this is a handy way to get ZAP up and running via Docker.

https://github.com/zaproxy/zaproxy/wiki/Docker

HTH

Answer 2

AngularJS makes heavy use of JavaScript, which the 'traditional' spider doesnt handle very well.

Instead use the ajax spider: https://github.com/zaproxy/zap-core-help/wiki/HelpAddonsSpiderAjaxConcepts this is slower but will handle any JS as it launches browsers to crawl the site.