3.2 OWASP ZAP

OWASP ZAP

What is OWASP ZAP?

OWASP ZAP (Zed Attack Proxy) is an open-source web application security scanner and proxy developed by the Open Web Application Security Project (OWASP). It is designed for testing web applications for security vulnerabilities during development and before deployment.

OWASP ZAP provides a wide range of features for both manual and automated testing of web applications. Some of its key features include:

1. Intercepting and modifying HTTP/HTTPS requests and responses for testing purposes.

2. Spidering functionality to automatically discover and map out the structure of a web application.

3. Active and passive scanning for identifying common security vulnerabilities such as cross-site scripting (XSS), SQL injection, and more.

4. Fuzzer tools for automated testing of input validation and error handling.

5. Support for scripting and automation through APIs and add-ons.

6. Reporting capabilities to generate detailed reports of security findings.

ZapPractical Ethical Hacker (CEH) Tools

OWASP ZAP Configuration

It usually works without a dedicated configuration, but if we are utilizing Burp Suite in parallel is necessary to take a specific configuration.

ZAP – Configuring Proxies

OWASP ZAP Features

Scope and Context

The Scope is the set of URLs you are testing, and is defined by the Contexts you have specified.

ZAP – Scope

Directory Enumeration

ZAP allows you to try to discover directories and files using forced browsing. A set of files are provided which contain a large number of file and directory names. ZAP attempts to directly access all of the files and directories listed in the selected file directly rather than relying on finding links to them.

ZAP – Forced Browse

Spidering

2.2 Passive Crawling & Spidering

Attacking HTTP Logon Form

Fuzzing

Fuzzing is a technique of submitting lots of data to a target (often in the form of invalid or unexpected inputs).

ZAP – Fuzzing