OWASP Zed Attack Proxy Demonstration - OWASP Bangalore Nov 22 2014

13
The OWASP Foundation http://www.owasp.org Copyright © The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the OWASP License. Nul/OWASP/G4H Bangalore 22 Nov 2014 ZAP Demonstration The OWASP Zed Attack Proxy Marudhamaran Gunasekaran Zap Contributor [email protected]

description

OWASP ZAP demonstration at Null/OWASP/G4H Bangalore meetup on Nov 22, 2014.

Transcript of OWASP Zed Attack Proxy Demonstration - OWASP Bangalore Nov 22 2014

Page 1: OWASP Zed Attack Proxy Demonstration - OWASP Bangalore Nov 22 2014

The OWASP Foundationhttp://www.owasp.org

Copyright © The OWASP FoundationPermission is granted to copy, distribute and/or modify this document under the terms of the OWASP License.

Nul/OWASP/G4H Bangalore

22 Nov 2014

ZAP DemonstrationThe OWASP Zed Attack Proxy

Marudhamaran GunasekaranZap Contributor

[email protected]

Page 2: OWASP Zed Attack Proxy Demonstration - OWASP Bangalore Nov 22 2014

2

Zed Attack Proxy - Then

• Released September 2010

• Ease of use a priority

• A fork of the well regarded Paros Proxy

• Involvement actively encouraged

• Adopted by OWASP October 2010

Page 3: OWASP Zed Attack Proxy Demonstration - OWASP Bangalore Nov 22 2014

3

Zed Attack Proxy - Now•An easy to use webapp pentest tool•Completely free and open source•Ideal for beginners•But also used by professionals•Ideal for devs, esp. for automated security tests•Becoming a framework for advanced testing•Included in all major security distributions•ToolsWatch.org Top Security Tool of 2013•Not a silver bullet!

Page 4: OWASP Zed Attack Proxy Demonstration - OWASP Bangalore Nov 22 2014

4

ZAP Principles•Free, Open source (always)

•Involvement actively encouraged

•Cross platform (write once, run anywhere)

•Easy to use (point and shoot)

•Easy to install (unzip & run)

•Internationalized (speaks 20+ languages)

•Fully documented (publish a book)

•Work well with other tools

•Reuse well regarded components (JBroFuzz, fuzzdb, DirBuster, CrawlJax, SQLMap?)

Page 5: OWASP Zed Attack Proxy Demonstration - OWASP Bangalore Nov 22 2014

5

Ohloh Statistics•Very High Activity

•The most active OWASP Project

•29 active contributors

•278 years of effort

•Source: http://www.ohloh.net/p/zaproxy

Page 6: OWASP Zed Attack Proxy Demonstration - OWASP Bangalore Nov 22 2014

6

The Main FeaturesAll the essentials for web application testing

•Intercepting Proxy

•Active and Passive Scanners

•Traditional and Ajax Spiders

•WebSockets support

•Forced Browsing (using OWASP DirBuster code)

•Fuzzing (using fuzzdb & OWASP JBroFuzz)

•Online Add-ons Marketplace

Page 7: OWASP Zed Attack Proxy Demonstration - OWASP Bangalore Nov 22 2014

7

The Additional Features• Auto tagging

• Port scanner

• Session comparison

• Invoke external apps

• API + Headless mode

• Dynamic SSL Certificates

• Anti CSRF token handling

Page 8: OWASP Zed Attack Proxy Demonstration - OWASP Bangalore Nov 22 2014

8

The Demo• Quick Start

• Browser configuration

• Intercepting proxy – breakpoints

• Passive scanner

• Auto tagging

• Parameters

1.

2.

3.

4.

Page 9: OWASP Zed Attack Proxy Demonstration - OWASP Bangalore Nov 22 2014

9

The Demo•

• New Alert

• Forced browsing

• Spiders

• Fuzzing

• Zap Marketplace

• Https Information

1.

2.

3.

4.

Page 10: OWASP Zed Attack Proxy Demonstration - OWASP Bangalore Nov 22 2014

10

The Demo• Comparing requests/responses

• Text Wizards

• Manual request editor

• Scan Options

• Safe/Protected/Standard modes

• Active scan

• Reports

1.

2.

3.

4.

5.

Page 11: OWASP Zed Attack Proxy Demonstration - OWASP Bangalore Nov 22 2014

Next talk?Advanced scanning

Contexts

WebSockets

postMessage monitoring

Users

PnH features

Scripts (Zest)

APIs

Automation

Page 12: OWASP Zed Attack Proxy Demonstration - OWASP Bangalore Nov 22 2014

ZAP 2.4.0Splash Screen (

http://tiny.cc/Vote4ZAPSplashScreen)

Unused tabs hidden

Scan dialogs with advanced options

Attack modes

Advanced fuzzing

Sequence scanning

Access control testing

Page 13: OWASP Zed Attack Proxy Demonstration - OWASP Bangalore Nov 22 2014

Any Questions?

http://www.owasp.org/index.php/ZAP