3

We currently use Test OWASP Zap. Integrated accordingly in a Jenkins pipeline, which performs a weekly vulnerability test.

We have now integrated RabbitMQ in our project, and here we don't know how we can test the RabbitMQ messages with OWASP ZAP.

Unfortunately there is hardly any information about this and the documentation of OWASP Zap is not very helpful in this respect.

Do any of you have any experience with this?

2
+150

RabbitMQ is part of the web-application, I dont think ZAP is designed to be used as a security scan between parts of a web-application. It focuses on the traffic between the browser and the web-application. I asume that the browser does not directly communicate with RabbitMQ. Wondering if you are looking at the right tool.

At its core, ZAP is what is known as a “man-in-the-middle proxy.” It stands between the tester’s browser and the web application so that it can intercept and inspect messages sent between browser and web application, modify the contents if needed, and then forward those packets on to the destination. It can be used as a stand-alone application, and as a daemon process.

enter image description here

https://www.zaproxy.org/getting-started/

3
  • The question is then which tool can do this ;) I don't even know of any vulnerability test tools that can do that ^^ – Mornon Nov 16 '20 at 11:00
  • Hello Nils, I have liked you despite the rightfully negative assessment. Nevertheless, I would like to bring the topic in more globally. The topic is "Automatic vulnerability testing of message brokers". Currently this can only be done manually (as far as I know!). But I think this is unthinkable in the agile world. – Mornon Nov 19 '20 at 10:43
  • 1
    This OWASP presentation mentions RabbitMQ en messaging in general owasp.org/www-pdf-archive//The_Messaging_Menagerie.pdf – Niels van Reijmersdal Nov 19 '20 at 10:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.