Vulnerability Analysis Tools Tutorials
owasp zap (zed attack proxy) vulnerability assessment tool tutorial
NOTICE: All the tutorials on this website are meant to help you find security vulnerabilties on your own network and devices to understand your security posture before black hats do. Penetration testing without a written consent is illegal and you can be prosecuted. Use these tutorials to secure your own networks or those whose permission you have been granted. Keep it ethical and keep it professional.
Table of Contents
introduction to owasp zap
OWASP ZAP (Zed Attack Proxy) is an open-source security testing tool designed to help find security vulnerabilities in web applications. It can be used by developers, penetration testers and ethical hackers. It is part of the Open Web Application Security Project (OWASP), which is a non-profit organization focused on improving the security of software. So, with that short introduction, what can this tool do for us as penetration testers and ethical hackers?
- Alerts and reports: Owasp ZAP provides detailed reports about all the identified vulnerabilities. It categorises these based on severerity. It can also make recommendations on what to do about them.
- spidering and fuzzing: ZAP can perform automated spidering to discover and map out the structure of a web application. It also supports fuzz testing, which involves sending invalid or unexpected input to identify potential vulnerabilities.
- Automated Scanning: ZAP can automatically scan web applications for various security vulnerabilities, including but not limited to cross-site scripting (XSS), SQL injection, security misconfigurations, and more.
- Proxy Functions: ZAP acts as an intercepting proxy, allowing users to intercept and modify HTTP and HTTPS traffic between the browser and the web application. This is particularly useful for understanding how data is transmitted and for identifying potential security issues.
- Authentication: ZAP supports various forms of authentication mechanisms, allowing users to test the security of applications that require login credentials.
Installing OWASP ZAP (Zed Attack Proxy) on Kali Linux and windows.
The tool is available on multiple platforms, in this, tutorial, I will be using it on Kali Linux so my screenshot is in Kali Linux. You first have to download the tool from Download ZAP (Zed Attack Proxy). On the link, download the "Linux Installer" if you are using Linux, otherwise select one for your own operating system.
 vulnerability assessment tool tutorial/linux installer.png)
after downloading the tool, go to your downloads folder. If you are on windows, simply double click the installer and click next on everything. For Linux users, there might be permissions issues depending on the owner ship of the file so you might want to change some permissions first. Only do this step if you have permission issues, otherwise go straight to running the installer.
#for Linux users with permissions errors.
cd
cd Downloads/
Now to start the installer, we will give execute permissions to other users just incase it is installed by another user than the one that owns it. We will then start the installer.
#linux users
chmod o+x ZAP_2_14_0_unix.sh
./ZAP_2_14_0_unix.sh
At this point the installer will will open and on the menu that comes, just click next on everything and it should install just fine. It will show up on your menu.
 vulnerability assessment tool tutorial/zap installed.png)
owasp zap (zed attack proxy) example usage: Automated Scanning
Let us run an automated scan. Open ZAP from the menu.
 vulnerability assessment tool tutorial/zap running.png)
Once it has loaded, it has a simply user interface, by default it will be running on port 8080 on your localhost.
 vulnerability assessment tool tutorial/opened .png)
Click on the automated scan button. This will bring some options in the same window.
- URL to attack: insert the URL, domain name or link to the website or a section of it in this section. I have tried my own website. Make sure you only run this on sites you have permissions to scan.
- Use traditional spider: This assumes that the website does not heavily use AJAX technologies. If it is a simple site without search, perhaps without a database, this might work better.
- Use AJAX spider: This assumes the website uses AJAX technologies heavily. These can have problems in the calls between the client and server. This is a better crawler to scan for vulnerabilities on such a website. In short, if the website seems complex, with a database and if it pulls a lot of data from various sources, this could work better at finding vulnerabilities.
- with: You can select the web browser to run the scan as.
- Attack: click on this to begin the scan
Try scanning a small site, large sites take a really long time. Almost every file is checked. When the scan begins, you can track what it is finding below.
 vulnerability assessment tool tutorial/running automated scan.png)
You can switch on the bottom windows to see the output, alerts,spider and general information. When the scan is done you can go to the left side of the window under sites.
 vulnerability assessment tool tutorial/results.png)
Depending on the size of the web application. There could be thousands of files under the site section. For each file you can inspect it further, perform an attack on it using fuzzing for example to determine the use of SQL injections or cross site scripts. But largely, what we want to do is understand how vulnerable the web applicaiton is so we will generate a report.
Click on report->generate report
 vulnerability assessment tool tutorial/report.png)
The report will open once completed as an HTML document. This will show the vulnerabilities and any issues that would have been found.
 vulnerability assessment tool tutorial/example of report.png)
The tool is easy to use and can be interesting for finding issues that are known and even those that are not. For now this is all I have.