OWASP ZAP (Zed Attack Proxy) is an open-source security testing tool designed to help find security vulnerabilities in web applications. It can be used by developers, penetration testers and ethical hackers. It is part of the Open Web Application Security Project (OWASP), which is a non-profit organization focused on improving the security of software. So, with that short introduction, what can this tool do for us as penetration testers and ethical hackers?
The tool is available on multiple platforms, in this, tutorial, I will be using it on Kali Linux so my screenshot is in Kali Linux. You first have to download the tool from Download ZAP (Zed Attack Proxy). On the link, download the "Linux Installer" if you are using Linux, otherwise select one for your own operating system.
after downloading the tool, go to your downloads folder. If you are on windows, simply double click the installer and click next on everything. For Linux users, there might be permissions issues depending on the owner ship of the file so you might want to change some permissions first. Only do this step if you have permission issues, otherwise go straight to running the installer.
#for Linux users with permissions errors.
cd
cd Downloads/
Now to start the installer, we will give execute permissions to other users just incase it is installed by another user than the one that owns it. We will then start the installer.
#linux users
chmod o+x ZAP_2_14_0_unix.sh
./ZAP_2_14_0_unix.sh
At this point the installer will will open and on the menu that comes, just click next on everything and it should install just fine. It will show up on your menu.
Let us run an automated scan. Open ZAP from the menu.
Once it has loaded, it has a simply user interface, by default it will be running on port 8080 on your localhost.
Click on the automated scan button. This will bring some options in the same window.
Try scanning a small site, large sites take a really long time. Almost every file is checked. When the scan begins, you can track what it is finding below.
You can switch on the bottom windows to see the output, alerts,spider and general information. When the scan is done you can go to the left side of the window under sites.
Depending on the size of the web application. There could be thousands of files under the site section. For each file you can inspect it further, perform an attack on it using fuzzing for example to determine the use of SQL injections or cross site scripts. But largely, what we want to do is understand how vulnerable the web applicaiton is so we will generate a report.
Click on report->generate report
The report will open once completed as an HTML document. This will show the vulnerabilities and any issues that would have been found.
The tool is easy to use and can be interesting for finding issues that are known and even those that are not. For now this is all I have.