Sweshi's Tutorials

Vulnerability Analysis Tools Tutorials


owasp zap (zed attack proxy) vulnerability assessment tool tutorial

NOTICE: All the tutorials on this website are meant to help you find security vulnerabilties on your own network and devices to understand your security posture before black hats do. Penetration testing without a written consent is illegal and you can be prosecuted. Use these tutorials to secure your own networks or those whose permission you have been granted. Keep it ethical and keep it professional.
Table of Contents
introduction to owasp zap

OWASP ZAP (Zed Attack Proxy) is an open-source security testing tool designed to help find security vulnerabilities in web applications. It can be used by developers, penetration testers and ethical hackers. It is part of the Open Web Application Security Project (OWASP), which is a non-profit organization focused on improving the security of software. So, with that short introduction, what can this tool do for us as penetration testers and ethical hackers?

  • Alerts and reports: Owasp ZAP provides detailed reports about all the identified vulnerabilities. It categorises these based on severerity. It can also make recommendations on what to do about them.
  • spidering and fuzzing: ZAP can perform automated spidering to discover and map out the structure of a web application. It also supports fuzz testing, which involves sending invalid or unexpected input to identify potential vulnerabilities.
  • Automated Scanning: ZAP can automatically scan web applications for various security vulnerabilities, including but not limited to cross-site scripting (XSS), SQL injection, security misconfigurations, and more.
  • Proxy Functions: ZAP acts as an intercepting proxy, allowing users to intercept and modify HTTP and HTTPS traffic between the browser and the web application. This is particularly useful for understanding how data is transmitted and for identifying potential security issues.
  • Authentication: ZAP supports various forms of authentication mechanisms, allowing users to test the security of applications that require login credentials.
Installing OWASP ZAP (Zed Attack Proxy) on Kali Linux and windows.

The tool is available on multiple platforms, in this, tutorial, I will be using it on Kali Linux so my screenshot is in Kali Linux. You first have to download the tool from Download ZAP (Zed Attack Proxy). On the link, download the "Linux Installer" if you are using Linux, otherwise select one for your own operating system.

owasp zap (zed attack proxy) vulnerability assessment tool : linux installer.

after downloading the tool, go to your downloads folder. If you are on windows, simply double click the installer and click next on everything. For Linux users, there might be permissions issues depending on the owner ship of the file so you might want to change some permissions first. Only do this step if you have permission issues, otherwise go straight to running the installer.

#for Linux users with permissions errors. cd cd Downloads/

Now to start the installer, we will give execute permissions to other users just incase it is installed by another user than the one that owns it. We will then start the installer.

#linux users chmod o+x ZAP_2_14_0_unix.sh ./ZAP_2_14_0_unix.sh

At this point the installer will will open and on the menu that comes, just click next on everything and it should install just fine. It will show up on your menu.

owasp zap (zed attack proxy) vulnerability assessment tool : zap installed.
owasp zap (zed attack proxy) example usage: Automated Scanning

Let us run an automated scan. Open ZAP from the menu.

owasp zap (zed attack proxy) vulnerability assessment tool :zap running.

Once it has loaded, it has a simply user interface, by default it will be running on port 8080 on your localhost.

owasp zap (zed attack proxy) vulnerability assessment tool :zap opened .

Click on the automated scan button. This will bring some options in the same window.

  • URL to attack: insert the URL, domain name or link to the website or a section of it in this section. I have tried my own website. Make sure you only run this on sites you have permissions to scan.
  • Use traditional spider: This assumes that the website does not heavily use AJAX technologies. If it is a simple site without search, perhaps without a database, this might work better.
  • Use AJAX spider: This assumes the website uses AJAX technologies heavily. These can have problems in the calls between the client and server. This is a better crawler to scan for vulnerabilities on such a website. In short, if the website seems complex, with a database and if it pulls a lot of data from various sources, this could work better at finding vulnerabilities.
  • with: You can select the web browser to run the scan as.
  • Attack: click on this to begin the scan

Try scanning a small site, large sites take a really long time. Almost every file is checked. When the scan begins, you can track what it is finding below.

owasp zap (zed attack proxy) vulnerability assessment tool : running automated scan.

You can switch on the bottom windows to see the output, alerts,spider and general information. When the scan is done you can go to the left side of the window under sites.

owasp zap (zed attack proxy) vulnerability assessment tool : results.

Depending on the size of the web application. There could be thousands of files under the site section. For each file you can inspect it further, perform an attack on it using fuzzing for example to determine the use of SQL injections or cross site scripts. But largely, what we want to do is understand how vulnerable the web applicaiton is so we will generate a report.

Click on report->generate report

owasp zap (zed attack proxy) vulnerability assessment tool : report.

The report will open once completed as an HTML document. This will show the vulnerabilities and any issues that would have been found.

owasp zap (zed attack proxy) vulnerability assessment tool : example of report.

The tool is easy to use and can be interesting for finding issues that are known and even those that are not. For now this is all I have.