We currently use Test OWASP Zap. Integrated accordingly in a Jenkins pipeline, which performs a weekly vulnerability test.
We have now integrated RabbitMQ in our project, and here we don't know how we can test the RabbitMQ messages with OWASP ZAP.
Unfortunately there is hardly any information about this and the documentation of OWASP Zap is not very helpful in this respect.
Do any of you have any experience with this?
RabbitMQ is part of the web-application, I dont think ZAP is designed to be used as a security scan between parts of a web-application. It focuses on the traffic between the browser and the web-application. I asume that the browser does not directly communicate with RabbitMQ. Wondering if you are looking at the right tool.
At its core, ZAP is what is known as a “man-in-the-middle proxy.” It stands between the tester’s browser and the web application so that it can intercept and inspect messages sent between browser and web application, modify the contents if needed, and then forward those packets on to the destination. It can be used as a stand-alone application, and as a daemon process.
