Support for fuzzing multiple parts

[zapbot]

The current fuzzer only allows you to fuzz one thing at a time (we wanted to get that
right first;).
But it would be really nice to be able to fuzz multiple parts...
Need to make sure we dont make the interface less usable though;)

Original issue reported on code.google.com by psiinon on 2011-11-09 16:52:39

[zapbot]

I definitely like the whole "select what you want to fuzz" interface, so if you could
somehow extend that it would be great. Maybe instead of having a "Fuzz" button on the
fuzzer selection window, you could have the option to select another part of the request,
and then at the end the button to start the fuzzing is on the Information Tab, where
it is for things like "Active Scan" or "Spider".

Original issue reported on code.google.com by adrianhayter on 2011-11-09 17:05:19

[zapbot]

So something like...

Highlight, right click and then select 'Fuzz' (as now)
Same dialog, but with option to 'Fuzz multiple strings' (or something)
If selected dialog disapears but previous selection highlighted in another colour.
Repeat until done.
Then click 'Fuzz' button?

Original issue reported on code.google.com by psiinon on 2011-11-09 17:17:27

[zapbot]

Sounds good. You also might want to include some (advanced) options for what happens
when one fuzzing file is longer than another. For example, if I fuzz a GET parameter
uid=xxx with SQL injections, but also fuzz the User-Agent, it's likely that the SQL
injection file(s) will be longer than the User-Agent file. The option to "wrap-around"
the smaller file(s) (i.e. once you reach the end, you start again from the top) or
to return to the default (pre-fuzzed) value would be good to have.

Original issue reported on code.google.com by adrianhayter on 2011-11-09 17:39:06

[zapbot]

Yes, makes sense.
Let us know if you think of any other options that would be useful...

Original issue reported on code.google.com by psiinon on 2011-11-09 18:49:47

[zapbot]

instead of selecting part and then saying fuzz why don't we give it a interface which
is like right click on request say fuzz then select fuzz parameters and we can even
integrate the fuzzer list with each parameter selection. so one parameter i might want
number enumeration another i might want XSS check's

Original issue reported on code.google.com by ant2010in on 2012-02-08 06:19:00

[zapbot]

More suggestions from this thread: http://lists.owasp.org/pipermail/owasp-zed-attack-proxy/2012-June/thread.html

-In addition, it would be great you could specify a depth first or breadth first brute
force strategy (where breadth first brute forcing is meant to avoid username-based
account lockouts).

Original issue reported on code.google.com by psiinon on 2012-06-19 08:17:23

[zapbot]

(No text was entered with this change)

Original issue reported on code.google.com by psiinon on 2014-01-16 16:48:04

• Labels added: Version-2.3.0

[zapbot]

This would be great. Also the ability to specify options and have ZAP generate the lists
rather than just text files. IE be able to say 5 char string using 0-9 and a-z etc

Thanks

Adam 

Original issue reported on code.google.com by adam.watson1 on 2014-01-31 16:14:01

[zapbot]

(No text was entered with this change)

Original issue reported on code.google.com by psiinon on 2014-08-28 12:14:31

• Labels added: Version-2.4.0
• Labels removed: Version-2.3.0

[zapbot]

Done as part of GSoC 2014 [1].

The enhancements mentioned in comments:
 - #3 and #6 will be done as part of Issue 1434;
 - #8 is already supported using the regex payload.

Please raise a new issue if I missed an enhancement mentioned in the comments (or comment
on Issue 1434 if not yet closed).

[1] https://code.google.com/p/zaproxy/wiki/GSoC_2014_Advanced_Fuzzing

Original issue reported on code.google.com by THC202 on 2015-03-17 03:51:39

• Labels removed: Version-2.4.0

[zapbot]

Fixed in 2.4.0

Original issue reported on code.google.com by psiinon on 2015-04-14 11:03:23