[FEATURE] Logging of evidence

First of all: great tool! ALready found some problems that needed fixing. So thank you for that! I have a suggestion below.

Problem Statement

I got some warnings about "ASTF-API2-2023 Missing Authentication Controls". I have added tons of debugging but could not find the culprit. Every request seemed to have a JWT Authorization header. So, I was looking to inspect the evidence of this problem outside my software (Laravel/Lumen Rest API). Unfortunately the ASTF tool itself did not supply these requests/responses.

Proposed Solution

A command line option to enable logging the http-requests and responses; would be great to be able to supply filename and export to JSON or HAR e.g.

Alternative Solutions

Currently I had to install OWASP ZAP and enable the proxy, run the ASTF through the proxy and inspect results.

Related OWASP API Security Standards

None

Additional Context

The OWASP ZAP proxy could supply some inspiration possibly?

Would you be willing to implement this feature?

• I'm willing to submit a PR for this feature
• I would need guidance to implement this feature
• [ x] I'm not able to implement this feature

Greetings Martin

Start by locating the command-line option handling and the code that sends HTTP requests and receives responses in the ASTF tool. Define the export behavior for a configurable filename and JSON or HAR output; done means captured requests and responses can be inspected outside the tested application.