Zed Attack Proxy Issue

[StephMeister]

Good day, all.

I have been testing ZAP on the Moth VM (from Bonsai Information Security). I first start using the spider, then I do an active scan. No problem so far. But, when I try to save a report, either in html or in xml, I run into issues. ZAP looks like it is saving the file, then it tries to open it in Firefox. However I get a "file not found error" error. I go look in the directory where the report is supposed to have been generated and the file is not there. As I am running as root, I know it is not an access rights issue. I am also aware that version 1.3.2 has an issue with saving file names without the extension, although it was corrected in version 1.3.3. I have tried to save with the file extension, but to no avail. I have even tried the windows version of ZAP 1.3.3, but no joy. I have a feeling that I am missing something very basic (for which I will probably kick myself over) but I can't seem to put my finger on it.

Any help on this would be appreciated.

[psiinon]

Good day, all.

I have been testing ZAP on the Moth VM (from Bonsai Information Security). I first start using the spider, then I do an active scan. No problem so far. But, when I try to save a report, either in html or in xml, I run into issues. ZAP looks like it is saving the file, then it tries to open it in Firefox. However I get a "file not found error" error. I go look in the directory where the report is supposed to have been generated and the file is not there. As I am running as root, I know it is not an access rights issue. I am also aware that version 1.3.2 has an issue with saving file names without the extension, although it was corrected in version 1.3.3. I have tried to save with the file extension, but to no avail. I have even tried the windows version of ZAP 1.3.3, but no joy. I have a feeling that I am missing something very basic (for which I will probably kick myself over) but I can't seem to put my finger on it.

Any help on this would be appreciated.

Can you have a look in the ZAP log to see if any errors are generated?
On Windows this will be under your user directory in OWASP ZAP/zap.log
On Linux it will be in ~/.ZAP/zap.log

As you spotted there was a problem with reports on Linux in 1.3.2 but that should be fixed in 1.3.3

btw I only spotted this thanks to a Google alert.
If you report this as a ZAP issue (Issues - zaproxy - OWASP ZAP: An easy to use integrated penetration testing tool for finding vulnerabilities in web applications. - Google Project Hosting) or on the dev mailing list (https://groups.google.com/forum/#!forum/zaproxy-develop) then you'll get quicker responses

Many thanks,

Psiinon