payload: {"action":"created","issue":{"url":"https://api.github.com/repos/zaproxy/zaproxy/issues/1133","repository_url":"https://api.github.com/repos/zaproxy/zaproxy","labels_url":"https://api.github.com/repos/zaproxy/zaproxy/issues/1133/labels{/name}","comments_url":"https://api.github.com/repos/zaproxy/zaproxy/issues/1133/comments","events_url":"https://api.github.com/repos/zaproxy/zaproxy/issues/1133/events","html_url":"https://github.com/zaproxy/zaproxy/issues/1133","id":85196819,"node_id":"MDU6SXNzdWU4NTE5NjgxOQ==","number":1133,"title":"Anti-CSRF Token check in URL","user":{"login":"zapbot","id":12745184,"node_id":"MDQ6VXNlcjEyNzQ1MTg0","avatar_url":"https://avatars2.githubusercontent.com/u/12745184?v=4","gravatar_id":"","url":"https://api.github.com/users/zapbot","html_url":"https://github.com/zapbot","followers_url":"https://api.github.com/users/zapbot/followers","following_url":"https://api.github.com/users/zapbot/following{/other_user}","gists_url":"https://api.github.com/users/zapbot/gists{/gist_id}","starred_url":"https://api.github.com/users/zapbot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zapbot/subscriptions","organizations_url":"https://api.github.com/users/zapbot/orgs","repos_url":"https://api.github.com/users/zapbot/repos","events_url":"https://api.github.com/users/zapbot/events{/privacy}","received_events_url":"https://api.github.com/users/zapbot/received_events","type":"User","site_admin":false},"labels":[{"id":220400965,"node_id":"MDU6TGFiZWwyMjA0MDA5NjU=","url":"https://api.github.com/repos/zaproxy/zaproxy/labels/Type-Enhancement","name":"Type-Enhancement","color":"ededed","default":false},{"id":220063776,"node_id":"MDU6TGFiZWwyMjAwNjM3NzY=","url":"https://api.github.com/repos/zaproxy/zaproxy/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2015-06-04T17:30:59Z","updated_at":"2019-09-23T12:35:17Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"```\nhey all,\n\ni'm currently facing a problem with tokens which are generated with every request from\nthe server and ZAProxy seems not to handle that properly, to make valid requests, e.g.\nfor fuzzing a special parameter.\n\nThe client request looks like this:\n\nPOST http://webapp.de/ptlweb/WebPortal?timeout=4931&applId=etretr&frame=content&wp_token_etretr=1783017392\nHTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Firefox/24.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3\nReferer: http://webapp.de/ptlweb/WebPortal?timeout=4931&applId=etretr&frame=content&wp_token_etretr=1075322898\nCookie: JSESSIONID=60CC585862E3194B3A3F78C736645B40.glebtcb21201_instanz_165; opttan_data=width_opttan_m%3D186\nConnection: keep-alive\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 72\nHost: webapp.de\n\nbezVerzeichnis=testdirectory&event___erzeugenVerzeichnis=Verzeichnis+erstellen\n\n\nthe value 1783017392 in wp_token_etretr changes with every request, so when i try to\nfuzz e.g. the parameter\nbezVerzeichnis with the same value in wp_token_etretr again nothing happens.\n\n\nIn the response body i find the post request like this:\n\n<div class=\"profiler-item\"><div class=\"profiler-line clearfix\"><span class=\"profiler-name\">POST\nhttp://webapp.de/etrweb/eTresor[requestParams]{bezVerzeichnis=testdirectory, event___erzeugenVerzeichnis=Verzeichnis\nerstellen, pid=45CE45259A457A289BBCFA3BFE09F020.glebtcb21201_165, wpsid=957D8B2EA2F3603839C91AA8CDAF4401.glebtcb21201_165,\nsprache=de, wpuri=/ptlweb/WebPortal, frame=content, kinNr=4931, applId=etretr, wp_token_etretr=1783017392,\ntimeout=4931}</span><span class=\"profiler-offset\">6 ms</span><span class=\"profiler-duration\">14\nms</span></div></div>\n\n\n\nthis part of the application uses the wp_token_etretr token another part uses another\ntoken e.g. requestId like here:\n\n\nPOST http://webapp.de/ptlweb/WebPortal?frame=content&applId=ebxebx&timeout=4931&actiondo=%2Fnewmail%2FsubmitMailForm.action%3FrequestId%3D-1163206364\nHTTP/1.1\nHost: webapp.de\n\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Firefox/24.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3\nReferer: http://webapp.de/ptlweb/WebPortal?frame=content&applId=ebxebx&timeout=4931&actiondo=%2Fnewmail%2FinitFlow.action%3FrequestId%3D1544695018\nCookie: JSESSIONID=957D8B2EA2F3603839C91AA8CDAF4401.glebtcb21201_instanz_165; opttan_data=width_opttan_m%3D186\nConnection: keep-alive\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 229\n\nsessionFacade.newMailWebBean.sendMessage.selectedMessageReceiverItemIndex=1&sessionFacade.newMailWebBean.sendMessage.messageSubject=test&sessionFacade.newMailWebBean.sendMessage.messageText=test123&navFormBean.submitButton=Senden\n\n\nCan you please enhance ZAP to check Anti-CSRF Tokens when they appear in the URL instead\nof the request body?\n\nwith kind regards,\nfrank\n\n```\n\nOriginal issue reported on code.google.com by `fboldewin` on 2014-03-31 18:47:37\n"},"comment":{"url":"https://api.github.com/repos/zaproxy/zaproxy/issues/comments/534079232","html_url":"https://github.com/zaproxy/zaproxy/issues/1133#issuecomment-534079232","issue_url":"https://api.github.com/repos/zaproxy/zaproxy/issues/1133","id":534079232,"node_id":"MDEyOklzc3VlQ29tbWVudDUzNDA3OTIzMg==","user":{"login":"knutsiem","id":325620,"node_id":"MDQ6VXNlcjMyNTYyMA==","avatar_url":"https://avatars3.githubusercontent.com/u/325620?v=4","gravatar_id":"","url":"https://api.github.com/users/knutsiem","html_url":"https://github.com/knutsiem","followers_url":"https://api.github.com/users/knutsiem/followers","following_url":"https://api.github.com/users/knutsiem/following{/other_user}","gists_url":"https://api.github.com/users/knutsiem/gists{/gist_id}","starred_url":"https://api.github.com/users/knutsiem/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/knutsiem/subscriptions","organizations_url":"https://api.github.com/users/knutsiem/orgs","repos_url":"https://api.github.com/users/knutsiem/repos","events_url":"https://api.github.com/users/knutsiem/events{/privacy}","received_events_url":"https://api.github.com/users/knutsiem/received_events","type":"User","site_admin":false},"created_at":"2019-09-23T12:35:17Z","updated_at":"2019-09-23T12:35:17Z","author_association":"NONE","body":"My use case would also benefit from more flexible anti-CSRF token support.\r\n\r\nIn my case, the token is part of the response body as a `<meta>` element. I figured I would be able to write an HTTP Sender script where I extract the token in `sendingRequest()` using and registering it with `ExtensionAntiCSRF.registerAntiCsrfToken()` in `responseReceived()`.\r\n\r\nSeeing @psiinon's comment above about `ExtensionAntiCSRF.registerAntiCsrfToken()` not being an option, I instead tried the more straightforward (and already written) httpsender script \"Capture and Replace Anti CSRF Token.js\" from the community scripts, https://github.com/zaproxy/community-scripts/blob/master/httpsender/Capture%20and%20Replace%20Anti%20CSRF%20Token.js.\r\n\r\nThis works great except for requests from Sequence scripts (#5590)."}}
other: {"actor":{"display_login":"knutsiem"}}