OWASP Zed Attack Proxy Demonstration - OWASP Bangalore Nov 22 2014
-
Upload
gmaran23 -
Category
Technology
-
view
633 -
download
0
description
Transcript of OWASP Zed Attack Proxy Demonstration - OWASP Bangalore Nov 22 2014
The OWASP Foundationhttp://www.owasp.org
Copyright © The OWASP FoundationPermission is granted to copy, distribute and/or modify this document under the terms of the OWASP License.
Nul/OWASP/G4H Bangalore
22 Nov 2014
ZAP DemonstrationThe OWASP Zed Attack Proxy
Marudhamaran GunasekaranZap Contributor
2
Zed Attack Proxy - Then
• Released September 2010
• Ease of use a priority
• A fork of the well regarded Paros Proxy
• Involvement actively encouraged
• Adopted by OWASP October 2010
3
Zed Attack Proxy - Now•An easy to use webapp pentest tool•Completely free and open source•Ideal for beginners•But also used by professionals•Ideal for devs, esp. for automated security tests•Becoming a framework for advanced testing•Included in all major security distributions•ToolsWatch.org Top Security Tool of 2013•Not a silver bullet!
4
ZAP Principles•Free, Open source (always)
•Involvement actively encouraged
•Cross platform (write once, run anywhere)
•Easy to use (point and shoot)
•Easy to install (unzip & run)
•Internationalized (speaks 20+ languages)
•Fully documented (publish a book)
•Work well with other tools
•Reuse well regarded components (JBroFuzz, fuzzdb, DirBuster, CrawlJax, SQLMap?)
5
Ohloh Statistics•Very High Activity
•The most active OWASP Project
•29 active contributors
•278 years of effort
•
•
•
•
•Source: http://www.ohloh.net/p/zaproxy
6
The Main FeaturesAll the essentials for web application testing
•Intercepting Proxy
•Active and Passive Scanners
•Traditional and Ajax Spiders
•WebSockets support
•Forced Browsing (using OWASP DirBuster code)
•Fuzzing (using fuzzdb & OWASP JBroFuzz)
•Online Add-ons Marketplace
7
The Additional Features• Auto tagging
• Port scanner
• Session comparison
• Invoke external apps
• API + Headless mode
• Dynamic SSL Certificates
• Anti CSRF token handling
•
8
The Demo• Quick Start
• Browser configuration
• Intercepting proxy – breakpoints
• Passive scanner
• Auto tagging
• Parameters
1.
2.
3.
4.
9
The Demo•
• New Alert
• Forced browsing
• Spiders
• Fuzzing
• Zap Marketplace
• Https Information
1.
2.
3.
4.
10
The Demo• Comparing requests/responses
• Text Wizards
• Manual request editor
• Scan Options
• Safe/Protected/Standard modes
• Active scan
• Reports
•
•
1.
2.
3.
4.
5.
Next talk?Advanced scanning
Contexts
WebSockets
postMessage monitoring
Users
PnH features
Scripts (Zest)
APIs
Automation
ZAP 2.4.0Splash Screen (
http://tiny.cc/Vote4ZAPSplashScreen)
Unused tabs hidden
Scan dialogs with advanced options
Attack modes
Advanced fuzzing
Sequence scanning
Access control testing
Any Questions?
http://www.owasp.org/index.php/ZAP