+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Trying to get OWASP ZAP to work with Tor (/showthread.php?tid=5855549)
Trying to get OWASP ZAP to work with Tor - torchic - Jun 29, 2018
Anyone know how to get this working on kali 2? I've installed tor and proxychains, got tor running and tried to start OWASP ZAP with the command
Quote:proxychains /usr/bin/zaproxy
And it just gives me an error because Tor is a SOCKS proxy not an HTTP proxy.
I've tried changing the OWASP ZAP JVM options and adding -DsocksProxyHost=127.0.0.1-DsocksProxyPort=9050 as an option, restarting ZAP and it doesn't work.
I've tried every damn thing I can find on the internet and I can't get it to work. Anyone have any idea?
RE: Trying to get OWASP ZAP to work with Tor - CyberStrike - Jun 29, 2018
Post the exact error you got. Also how does your proxychains.conf look? It should have the following entry :
[ProxyList]
# add proxy here ...
# meanwile
# defaults set to "tor"
socks4 127.0.0.1 9050
Also what chain are you using strict/dynamic/random you probably want strict.
Edit: You also will want to specify in the browser ZAP's proxy.
RE: Trying to get OWASP ZAP to work with Tor - torchic - Jun 29, 2018
Hey thanks for the reply! I can't post links so URLs will be shortened.
proxychains.conf is correct with strict.
web browser proxy settings are 127.0.0.1 port 8080
With ZAP connection setting on "use outgoing proxy server" set at 127.0.0.1 port 9050
Use web browser to check.torproject.org gives the following error.
Quote:This is a SOCKs proxy, not an HTTP proxy.
It appears you have configured your web browser to use this Tor port as an HTTP proxy.
This is not correct: This port is configured as a SOCKS proxy, not an HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPort configuration option in place of, or in addition to, SOCKSPort. Please configure your client accordingly.
See torproject.org/documentation.html for more information.
In ZAP sending a manual http request to check.torproject.org returns same error.
Changing ZAP connection options to remove "connect to outgoing proxy" and restarting ZAP does ..
Web browser check.torproject.org loads but says not connected to Tor.
Manual http request in ZAP to same URL returns same error.
RE: Trying to get OWASP ZAP to work with Tor - CyberStrike - Jun 30, 2018
This guy used privoxy a http proxy and pointed it to tor seems that this is the way to go
https://www.youtube.com/watch?v=eDvUtF_tG5w
Now looking at Owasps github I found and if you go down a bit you will see a work around to use socks, I think you may have tried it some of the code looked the same as what you were trying.
https://github.com/zaproxy/zaproxy/issues/29