0

During scanning my https website via owasp zap , I found that username and password information is not encrypted. What could be the reason and how to fix. Please see below screenshot of ZAP.enter image description here

Muhammad Ali Khamis
  • 137
  • 1
  • 3
    I'm not familiar with zap, so maybe I'm missing something. What seems to be the problem? As far as I can tell, the username and password are sent on an https:// connection, so they are encrypted. – Gilles 'SO- stop being evil' Jul 25 '19 at 06:56
  • Concern is that they are not encrypted. Is this SSL certificate issue? – Muhammad Ali Khamis Jul 25 '19 at 06:57
  • 1
    @MuhammadAliKhamis ZAP is a man-in-the-middle proxy, meaning that it sits in the middle of a normally-encrypted connection. The only reason it can do this is that you trusted its certificate on the client, which allows it to impersonate the server. – Gordon Davisson Jul 25 '19 at 07:04
  • @Gilles: The communication channel is encrypted, the credentials are transmitted over the encrypted communication channel in plain text. – Jeroen Jul 25 '19 at 08:42
  • @GordonDavisson how about chrome dev tools (inspect element). I can see there also. – Muhammad Ali Khamis Jul 25 '19 at 09:04
  • Chrome knows the cleartext, because it is on one end of the End-to-End encryption.

    And as @Jeroen-ITNerdbox hast stated, they get transmitted in clear text inside the encrypted channel.

     – mhr Jul 25 '19 at 13:59

1 Answers1

5

OWASP ZAP is like a MITM proxy very similar to Burp suite.Ofcourse it can read the https because you must have installed a Root CA certificate while setting it up.There is nothing wrong with your website in regards to your question

yeah_well
  • 3,804
  • 1
  • 15
  • 32
  • I can see the information via chrome inspect. Is this still due to Root CA certificate? – Muhammad Ali Khamis Jul 25 '19 at 07:33
  • 6
    @MuhammadAliKhamis If you mean the browser dev tools, well, obviously you can; the browser does all the encryption (and decryption) so it knows both the plaintext and the ciphertext, and the dev tools would be quite useless if they showed ciphertext instead of plaintext. – CBHacking Jul 25 '19 at 08:12