Error: Blank website "JavaScript is required to sign in." + "User-Agent string appears to be from an automated process"

[Am0rphous]

Hi,
I decided to test Foxyhound, but I've encountered some errors. I'm trying to open an azure web to analyze in ZAP.

Steps to reproduce

• Install Zed Attack Proxy + Foxyhound ZAP Add-on.
• Download e.g. Vanilla Foxhound (or Foxhound with Playwright Integration) from https://foxhound.ias.tu-bs.de/
• Extract zip file
• Configure Foxyhound add-on through Options -> Selenium -> Firefox -> Add and choose the extracted foxyhound folder with the foxyhound binary.
• Finish with "Add" and "Ok".
• View -> All tabs -> Foxyhound tab
• Launch Foxyhound

In the browser, the first web site is white/blank

https://zap/zapCallBackUrl/-3231344173497677958?zapenable=true&zapid=8f1f8d2a-5805-47fa-8969-9ce7f1470f6a

The same happens when trying to access my azure web app, where i need to log into a microslop account on something that looks like https://login.microsoftonline.com/ blabla

By using console in the browser and inspecting the Response we can see:

#Error message
"We can't sign you in
JavaScript is required to sign in. Your browser either does not support JavaScript or it is being blocked.
Enable JavaScript in your browser or use one which supports it."

The settings have not beet tweaked, except adding Zaps root CA.
By navigating to about:config and searching for javascript.enabled I can see the setting is toggled true.

Testing another URL by navigating to e.g. https://www.microsoft.com yields the error

Your current User-Agent string appears to be from an automated process, if this is incorrect, please click this link: [United States English Microsoft Homepage](http://www.microsoft.com/en/us/default.aspx?redir=true)

Testing with Github.com gives no errors.

My question: Is there something I can do to get passed this? Any tricks and tips is much appreciated!

Best regards

[leeN]

Can you verify that this works if you do it manually? I.e., start Foxhound and use it as a regular browser? At least visiting https://www.microsoft.com works without errors for me with Foxhound.

If that works for you, maybe Zap is messing with the user agent. That would simplify where to look!

[leeN]

Okay, I can reproduce that, but ZAP does not change the user agent, really weird. Will look into this deeper next week, as there seems to be something else in play.

[Am0rphous]

Thank you for the response @leeN !

I discovered another weird thing. When doing a challenge on HackTheBox, the source code of a Web app in Firefox (using Zap) removed a small critical piece of code. Opening the same URL in e.g. Brave showed the expected code being present.

The code was simply disabled> which was part of a button element. This piece appeared using Brave, and thus changing it to enabled resulted in being able to complete a task.

I'm not sure if this is related, but I'll mention it just in case.