You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
> You can highlight important information in your articles or docs using different types of callouts (also known as admonitions – or alerts, as used in [the Hugo docs](https://gohugo.io/render-hooks/blockquotes/#alerts)).
124
124
125
-
The examples below use the same syntax as in Github Markdown. The template responsible for rendering them is at `site/layouts/_default/_markup/render-blockquote.html`
125
+
For compatibility with both content and layout files, we use a mix of shortcodes and partials to display blockquote alerts. Partials work in layout, but not content files. Shortcodes work in content, but not layout files. Use the partial in layout files, and the shortcode (which internally calls the partial) in content files.
126
126
127
+
The partial is at `site/layouts/partials/blockquote-alert.html`, and the shortcode is at `site/layouts/shortcodes/blockquote-alert.html`.
128
+
129
+
There are five available alert types as shown in the examples below:
130
+
131
+
- note
132
+
- tip
133
+
- important
134
+
- warning
135
+
- caution
136
+
137
+
Omit the `title` parameter to keep the alert type as the default title (for example, a note alert will have "Note" as its title):
> Useful information that users should know, even when skimming content.
130
162
131
-
> [!TIP]
132
-
> Helpful advice for doing things better or more easily.
163
+
In layout files, call the partial directly. Just like shortcode content, anything passed to the `content` parameter is parsed as Markdown. To pass raw HTML instead, use the `html` parameter. Again, the title parameter is optional and will default to the alert type:
133
164
134
-
> [!IMPORTANT]
135
-
> Key information users need to know to achieve their goal.
165
+
```html
166
+
<!-- Partials in layout files -->
167
+
168
+
<!-- Anything passed via `content` is interpreted as Markdown -->
169
+
170
+
{{ partial "blockquote-alert.html" (dict
171
+
"type" "note"
172
+
"title" "Optional custom title"
173
+
"content" "Useful information that users should know, even when skimming content."
174
+
) }}
175
+
176
+
{{ partial "blockquote-alert.html" (dict
177
+
"type" "tip"
178
+
"title" "Optional custom title"
179
+
"content" "Helpful advice for doing things better or more easily."
180
+
) }}
181
+
182
+
{{ partial "blockquote-alert.html" (dict
183
+
"type" "important"
184
+
"title" "Optional custom title"
185
+
"content" "Key information users need to know to achieve their goal."
186
+
) }}
187
+
188
+
{{ partial "blockquote-alert.html" (dict
189
+
"type" "warning"
190
+
"title" "Optional custom title"
191
+
"content" "Urgent info that needs immediate user attention to avoid problems."
192
+
) }}
193
+
194
+
{{ partial "blockquote-alert.html" (dict
195
+
"type" "caution"
196
+
"title" "Optional custom title"
197
+
"content" "Advises about risks or negative outcomes."
198
+
) }}
199
+
```
200
+
201
+
In addition to simple string content as shown above, you can also pass in complex nested content with multiple paragraphs and elements:
136
202
137
-
> [!WARNING]
138
-
> Urgent info that needs immediate user attention to avoid problems.
203
+
```md
204
+
<!-- Shortcode example with more complex content -->
This is a tip with **bold text** and _italic_ text.
208
+
209
+
This is a second paragraph in the same alert.
210
+
211
+
- List item 1
212
+
- List item 2
213
+
{{< /blockquote-alert >}}
214
+
```
215
+
216
+
You can do similar in partials. These are all valid options. Additionally, you can assign content to a variable before passing it in, which helps with formatting in longer templates:
217
+
218
+
```html
219
+
<!-- You can wrap your markdown content in backticks if it doesn't itself contain backticks -->
220
+
<!-- Note that indented lines could be interpreted as a preformatted code block. -->
221
+
{{ $alertContent := `This is a tip with **bold text** and _italic_ text.
"This is a tip with **bold text** and _italic_ text.\n\n"
238
+
"This is a second paragraph in the same alert.\n"
239
+
"- List item 1\n"
240
+
"- List item 2\n\n"
241
+
"`Here's some text in backticks.`"
242
+
}}
243
+
244
+
{{ partial "blockquote-alert.html" (dict
245
+
"type" "tip"
246
+
"title" "Optional custom title"
247
+
"content" $alertContent
248
+
) }}
249
+
250
+
<!-- Pass HTML with nested elements -->
251
+
{{ partial "blockquote-alert" (dict
252
+
"type" "caution"
253
+
"title" "Be Careful!"
254
+
"html" "<p>This is a <strong>caution</strong> message.</p><p>It has multiple paragraphs.</p>"
255
+
) }}
256
+
```
257
+
258
+
259
+
> [!IMPORTANT]
260
+
> When working with complex content, make sure to handle line breaks properly within the strings passed to the `content` or `html` parameters. For example, the following will throw a parse error (`html: overlay: parse failed unterminated quoted string in action`):
139
261
140
-
> [!CAUTION]
141
-
> Advises about risks or negative outcomes.
142
262
```
263
+
{{ partial "blockquote-alert" (dict
264
+
"type" "caution"
265
+
"title" "Be Careful!"
266
+
"html" "<p>This is a <strong>caution</strong> message.</p>
267
+
<p>It has multiple paragraphs.</p>"
268
+
) }}
269
+
```
270
+
271
+
To avoid this, you can use either of the following options:
272
+
273
+
- Keep everything on a single line
274
+
- Use string concatenation (whether in a variable or directly)
143
275
144
276
#### Layouts
145
277
For controlling what HTML is rendered, you need to work with the site templates. In the directory, `site/layouts/`, you'll find a number of HTML files with various template tags. The first file to check out is `site/layouts/_default/baseof.html` - this is the base layout Hugo uses to build your site that templates extend. Hugo has a lookup order for associating a content entry to a template. A single entry whose type is post (`type: post`), Hugo will look for a layout in `site/layouts/post/single.html`, and if that does not exist, it will fallback to `site/layouts/_default/single.html`.
> If you have any issues launching your browser from ZAP, see the following pages for help. ZAP uses add-ons to enhance its core features, including ones which provide webdrivers for interfacing with supported browsers. These are installed by default and expose some configurable options:
66
-
>
67
-
> 1.[How can I fix 'browser was not found'?](/faq/how-can-i-fix-browser-was-not-found/) - ZAP Docs (FAQ)
If you have any issues launching your browser from ZAP, see the following pages for help. ZAP uses add-ons to enhance its core features, including ones which provide webdrivers for interfacing with supported browsers. These are installed by default and expose some configurable options:
66
+
67
+
1.[How can I fix 'browser was not found'?](/faq/how-can-i-fix-browser-was-not-found/) - ZAP Docs (FAQ)
Assuming you’ve opened the lab in a browser configured to proxy through ZAP, let’s try to log in with a random password. We want to capture a POST request we can work with in ZAP. I’ll try “randompass”. We’re notified that this is an “Incorrect password”, which is expected:
72
73
@@ -96,8 +97,9 @@ After one minute, we can indeed make more login attempts. The idea is that if we
96
97
97
98
If we enter our own credentials, `wiener:peter`, on every third login attempt, the IP block never activates. Each successful login resets the counter tracking the number of failed login attempts. We can keep going until we’ve tried enough passwords from our wordlist to find the right one for Carlos' account.
98
99
99
-
> [!NOTE]
100
-
> This bypass — taking advantage of a logic flaw to reset the failure counter — enables us to brute-force Carlos’ password and successfully solve this lab. Although not the point of the lab, we can also wait out the IP block since we’re dealing with only a few credentials. This is covered in “Method 2: Wait Out the IP Block”.
100
+
{{< blockquote-alert type="note">}}
101
+
This bypass — taking advantage of a logic flaw to reset the failure counter — enables us to brute-force Carlos’ password and successfully solve this lab. Although not the point of the lab, we can also wait out the IP block since we’re dealing with only a few credentials. This is covered in “Method 2: Wait Out the IP Block”.
102
+
{{< /blockquote-alert >}}
101
103
102
104
What about changing our IP address? I used the [`X-Forwarded-For`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Forwarded-For) header successfully in another lab. But the server here appears to block IPs based on the client's actual IP address (determined by the network layer rather than HTTP headers from the application layer), which makes sense in the context of rate-limiting. Rotating IP addresses via a proxy or VPN could work, but we won’t explore that here.
103
105
@@ -564,8 +566,9 @@ All functions, except the `log` function, are part of a required interface that
> Refer to the default templates for the interfaces required for each script type. You can find these in the Templates section of the Scripts tab. They include documentation comments describing each function and its parameters. You can also create new scripts from the templates.
569
+
{{< blockquote-alert type="note">}}
570
+
Refer to the default templates for the interfaces required for each script type. You can find these in the Templates section of the Scripts tab. They include documentation comments describing each function and its parameters. You can also create new scripts from the templates.
571
+
{{< /blockquote-alert >}}
569
572
570
573
You can save the file now. Also, check that the script is enabled, as disabled scripts won’t be available for selection when needed. If you missed the *Enable* checkbox earlier, you can right-click the filename in the *Scripts* tab and select *Enable Script(s)*.
571
574
@@ -583,10 +586,11 @@ After you open the *Add Payload* dialog, you can add the Payload Generator scrip
583
586
584
587
Save the payload and return to the main Fuzzer dialog. Then, run the Fuzzer with *Start Fuzzer*.
585
588
586
-
> [!IMPORTANT]
587
-
> You might notice that even though the payloads are generated correctly (as the logs in the script output panel show), the requests are sent in the wrong order. This causes an unexpected IP block early on. As a result, most of the requests are rejected with the message: `You have made too many incorrect login attempts. Please try again in 1 minute(s).`
588
-
>
589
-
> This is due to the Fuzzer’s concurrency settings. You can enable sequential execution by setting the number of execution threads to 1. However, this slows down the Fuzzer a great deal. An alternative is to throttle requests with a small delay of 100–200 milliseconds. See [Options Fuzzer screen](/docs/desktop/addons/fuzzer/options/) for more detail.
589
+
{{< blockquote-alert type="important">}}
590
+
You might notice that even though the payloads are generated correctly (as the logs in the script output panel show), the requests are sent in the wrong order. This causes an unexpected IP block early on. As a result, most of the requests are rejected with the message: `You have made too many incorrect login attempts. Please try again in 1 minute(s).`
591
+
592
+
This is due to the Fuzzer’s concurrency settings. You can enable sequential execution by setting the number of execution threads to 1. However, this slows down the Fuzzer a great deal. An alternative is to throttle requests with a small delay of 100–200 milliseconds. See [Options Fuzzer screen](/docs/desktop/addons/fuzzer/options/) for more detail.
593
+
{{< /blockquote-alert >}}
590
594
591
595
You can skip over the next section and head to [Have Username, Got Password](#have-username-got-password).
592
596
@@ -715,8 +719,9 @@ You can optionally move the script to the top of the processor list. Then, run t
715
719
716
720
Once the Fuzzer is done, we can inspect the results. We’re looking for indications of a successful login. So, we’ll sort the results in descending order using the status code column (simply “*Code”* in the UI).
717
721
718
-
> [!NOTE]
719
-
> Both of these solutions are valid. As you might have noticed if you’ve solved a lab more than once, different lab instances can have different password solutions. So, you could see different passwords than shown below.
722
+
{{< blockquote-alert type="note">}}
723
+
Both of these solutions are valid. As you might have noticed if you’ve solved a lab more than once, different lab instances can have different password solutions. So, you could see different passwords than shown below.
724
+
{{< /blockquote-alert >}}
720
725
721
726
### Method 1: Interleave Wordlists With Valid Credentials
> Please do not ask questions as issues - they will be closed and you will be redirected to the [ZAP user group](https://groups.google.com/group/zaproxy-users).
66
+
{{< blockquote-alert type="warning">}}
67
+
Please do not ask questions as issues - they will be closed and you will be redirected to the [ZAP user group](https://groups.google.com/group/zaproxy-users).
0 commit comments