I'm trying to do some penetration testing of REST Api using ZAP. Api uses windows authentication [domain\username] and is hosted locally on a specific port. First I did a test using postman to try to connect and make an example request. My config looked like this:
I decided to replicate this setup in OWASP zap. I set up my user:
then I set up authentication options in session properties:
and session management options:
I get Unauthorized and BadRequest responses when tryng to perform Active Scan in ZAP. I tried different user names and ports but it seems that there is some small piece missing in my config. I came across a link on their github page:
but it didn't solve my problem.
How should I set up ZAP to use NTLM authentication? I'm suprised that I was able to set this up in Postman in 5 minutes, but in ZAP it took me two days already and still nothing.
Oh, and not to mention that in C# code it was also 10 minutes of work using default credentials injected into httpclient through httpclienthandler class:
ICredentials credentials = CredentialCache.DefaultCredentials;
var clientHandler = new HttpClientHandler()
{
Credentials = credentials
};
var client = new HttpClient(clientHandler);
var resp = client.GetAsync(new Uri(apiUrl)).Result;
Any help appreciated. Thank you
