OWASP ZAP - how to authenticate when there is no login URL, because the form is shown by a dynamic popup?

Question

I don't know of any method about opening or accessing a dynamic popup.

I checked alternative authenticate methods but I think they would not work here. I am new to this tool but if I could solve this it would fix the bottleneck I am facing for 2 days.

Answer 1

You can use selenium scripts in ZAP to invoke the login pop-up; once it appears browser-based auth can be used to fill the form.

Here's an example selenium script that runs post-login to fill OTP, you need to do something relevant but pre-login: https://github.com/zaproxy/community-scripts/blob/main/selenium/FillOTPInMFA.js