nl_tokens: The authenticate function is called whenever ZAP requires to authenticate for a Context for which this script was selected as the Authentication Method . The function should send any messages that are required to do the authentication and should return a message with an authenticated response so the calling method . NOTE : Any message sent in the function should be obtained using the helper . prepareMessage () method . Parameters : helper - a helper class providing useful methods : prepareMessage () sendAndReceive ( msg ) paramsValues - the values of the parameters configured in the Session Properties - > Authentication panel . The paramsValues is a map having as keys the parameters names ( as returned by the getRequiredParamsNames () and getOptionalParamsNames () functions below ) credentials - an object containing the credentials values as configured in the Session Properties - > Users panel . The credential values can be obtained via calls to the getParam ( paramName ) method . The param names are the ones returned by the getCredentialsParamsNames () below
pl_tokens: function authenticate ( helper , paramsValues , credentials ) { print ( "Authenticating via JavaScript script..." ) ; // Make sure any Java classes used explicitly are imported var HttpRequestHeader = Java . type ( "org.parosproxy.paros.network.HttpRequestHeader" ) var HttpHeader = Java . type ( "org.parosproxy.paros.network.HttpHeader" ) var URI = Java . type ( "org.apache.commons.httpclient.URI" ) // Prepare the login request details var requestUri = new URI ( paramsValues . get ( "Target URL" ) , false ) ; var requestMethod = HttpRequestHeader . POST ; // Build the request body using the credentials values var extraPostData = paramsValues . <mask> ( "Extra POST data" ) ; var requestBody = paramsValues . get ( "Username field" ) + "=" + encodeURIComponent ( credentials . getParam ( "Username" ) ) ; requestBody += "&" + paramsValues . get ( "Password field" ) + "=" + encodeURIComponent ( credentials . getParam ( "Password" ) ) ; if ( extraPostData . trim ( ) . length ( ) > 0 ) requestBody += "&" + extraPostData . trim ( ) ; // Build the actual message to be sent print ( "Sending " + requestMethod + " request to " + requestUri + " with body: " + requestBody ) ; var msg = helper . prepareMessage ( ) ; msg . setRequestHeader ( new HttpRequestHeader ( requestMethod , requestUri , HttpHeader . HTTP10 ) ) ; msg . setRequestBody ( requestBody ) ; // Send the authentication message and return it helper . sendAndReceive ( msg ) ; print ( "Received response status code: " + msg . getResponseHeader ( ) . getStatusCode ( ) ) ; return msg ; }