[torchic]

Anyone know how to get this working on kali 2? I've installed tor and proxychains, got tor running and tried to start OWASP ZAP with the command

proxychains /usr/bin/zaproxy

And it just gives me an error because Tor is a SOCKS proxy not an HTTP proxy.


I've tried changing the OWASP ZAP JVM options and adding -DsocksProxyHost=127.0.0.1-DsocksProxyPort=9050 as an option, restarting ZAP and it doesn't work.

I've tried every damn thing I can find on the internet and I can't get it to work. Anyone have any idea?

[CyberStrike]

Post the exact error you got. Also how does your proxychains.conf look? It should have the following entry :

[ProxyList]
# add proxy here ...
# meanwile
# defaults set to "tor"
socks4 127.0.0.1 9050

Also what chain are you using strict/dynamic/random you probably want strict.

Edit: You also will want to specify in the browser ZAP's proxy.

[torchic]

Hey thanks for the reply! I can't post links so URLs will be shortened.

proxychains.conf is correct with strict.

web browser proxy settings are 127.0.0.1 port 8080

With ZAP connection setting on "use outgoing proxy server" set at 127.0.0.1 port 9050

Use web browser to check.torproject.org gives the following error.

This is a SOCKs proxy, not an HTTP proxy.

It appears you have configured your web browser to use this Tor port as an HTTP proxy.

This is not correct: This port is configured as a SOCKS proxy, not an HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPort configuration option in place of, or in addition to, SOCKSPort. Please configure your client accordingly.

See torproject.org/documentation.html for more information.

In ZAP sending a manual http request to check.torproject.org returns same error.

Changing ZAP connection options to remove "connect to outgoing proxy" and restarting ZAP does ..

Web browser check.torproject.org loads but says not connected to Tor.

Manual http request in ZAP to same URL returns same error.

[CyberStrike]

This guy used privoxy a http proxy and pointed it to tor seems that this is the way to go

https://www.youtube.com/watch?v=eDvUtF_tG5w

Now looking at Owasps github I found and if you go down a bit you will see a work around to use socks, I think you may have tried it some of the code looked the same as what you were trying.

https://github.com/zaproxy/zaproxy/issues/29