From 8b2791bf7a1f40f842ba71f6b643dea0baaa3fa2 Mon Sep 17 00:00:00 2001 From: Rick M Date: Tue, 25 Feb 2025 08:56:52 -0500 Subject: [PATCH] Tweak ZAP references ZAP left OWASP over a year ago, this just adjust naming. --- s3.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/s3.md b/s3.md index 1003b49..ed31eb9 100644 --- a/s3.md +++ b/s3.md @@ -43,8 +43,8 @@ amazonaws A brute-force approach, possibly based on a word-list of common words along with specific words coming from the domain under testing, might be useful in identifying S3 buckets. As described in the previous section, S3 buckets are identified by a predefined and predictable schema that can be useful for buckets identification. By means of an automatic tool it is possible to test multiple URLs in search of S3 buckets starting from a word-list. -In OWASP ZAP (v2.7.0) the fuzzer feature can be used for testing: -# With OWASP ZAP up and running, navigate to https://s3.amazonaws.com/bucket to generate a request to https://s3.amazonaws.com/bucket in the Sites panel; +In ZAP the fuzzer feature can be used for testing: +# With ZAP up and running, navigate to https://s3.amazonaws.com/bucket to generate a request to https://s3.amazonaws.com/bucket in the Sites panel; # From the Sites panel, right click on the GET request and select Attack -> Fuzz to configure the fuzzer; # Select the word bucket from the request to tell the fuzzer to fuzz in that location; # Click Add and Add again to specify the payload the fuzzer will use;