Elvis Wiki - User contributions [en]

OWASP ZAP

2020-12-21T09:58:18Z

MMuszik:

== Introduction ==
=== About ===
ZAP is short for Zed Attack Proxy. Before we delve into details as to what this means, what it is about, why it was created and what it can be used for, let us start by having a look at the ''principles of ZAP'' first for a better understanding.

The principles are:
* It is free, open source which means anyone can access and use it.
* It is also cross platform that is it works on Linux, Windows and Macs.
* It is easy to use; any user be it beginner or a professional can use it easily.
* It is easy to install; it requires Java Runtime Environment but everything else is included in standard downloads.
* It is fully internationalized, i.e., it has been translated to many other languages.
* It is fully documented, set of useful documents and helpline files are included.
* It works well with other tools, so that we can use other tools in conjunction with zap if we need to.
* It supports the use of well-regarded components.
These principles can be seen as the motivation behind ZAP, to summarise, it is designed to give everyone interested the chance to easily run security tests, at no cost, no matter their experience, the computer they use or the language they speak.
OWASP (Open Web Application Security Project) is a non-profit organisation that publishes freely-available articles, and aside from tools like ZAP they also provide documentation and technologies that deal with web application security. A lot of other security publications refer to the OWASP publications, for example the OWASP Top 10 which is looking at the biggest security risks for organisations and which will be featured in its own chapter in this here paper later on.
They also offer a Testing guide as well as a Development guide offering best practice information to those interested and many more interesting resources.

=== Description ===
ZAP’s focus is on testing web applications, the core idea behind it is a ”Man-in-the-Middle proxy”, that is, all web traffic between the web browser and the web application is first directed through ZAP. The data and messages can be intercepted, inspected, even modified before they are forwarded to their actual destination.
There are different ways to run ZAP, it is possible to use it as a stand-alone application (Java 8+ is required) or as a daemon process.

It is also possible to run ZAP in combination with another proxy, e.g. if a company runs their web traffic through their own proxy or firewall solution first. In this case we configure our browser to connect to ZAP, and then we can configure ZAP to connect to that other proxy.

There are various Add-ons as well as an API which make it possible to be used in a variety of scenarios and also to extend ZAP further in the future.
As stated in the principles, ZAP targets all skill levels, from those new to security testing who will probably start out by using automated tests, to developers, to those that run security tests for a living and can be considered specialists, making use of a variety of features including manual tests. The flexibility and extensibility (via add-ons in the ZAP marketplace that is part of the client) that ZAP provides make it a popular choice among security testers, add to that it is available for free and for pretty much every major operating system.
Since we’re talking about security, to a lot of people it is also important to know what their security tools really do. ZAP is open source and code examination is possible if so desired, one can look at how certain functions are implemented and the developers are transparent about which data ZAP is ”sending home” (e.g. checks for new versions), and also how that background data can be controlled or even disabled (where possible).
The ZAP community is also very open to new developers, anyone can submit bug fixes or create additional features for ZAP.

==How-To==
===Installation===
[[File:Zap-installation.png|thumb|ZAP Installation]]

First, go to the [https://www.zaproxy.org/download/ Download section on the official website for ZAP] and select the installer for your operating system.

Additionally, a Java version 8 or higher must be installed. That’s pretty much it, one needs to agree to the terms of service and then ZAP is ready to go.

=== Test target ===

If you want to try out the features of ZAP and do not want to set up your own server, you can find places like [https://public-firing-range.appspot.com/ https://public-firing-range.appspot.com/] which is a free-to-use online installation of Google's Firing Range. Do NOT run active features of ZAP against public websites without permission, you might alter data and this kind of attack can be prosecuted!

===Quickstart/Automated Scan===
[[File:Zap-persist session.png|thumb|ZAP Session Persistence]]
After opening ZAP you are asked if you want to persist the session. Answer "No" to quickly skip to the Quickstart.
[[File:Zap-quickstart.png|thumb|ZAP Quickstart]]
The easiest way to start using ZAP is via the Quick Start tab. Quick Start is a ZAP add-on that is included automatically when you installed ZAP.
To run a Quick Start Automated Scan:
* Start ZAP and click the Quick Start tab of the Workspace Window.
* Click the large Automated Scan button.
* In the URL to attack text box, enter the full URL of the web application you want to attack.
* Click the Attack button

===Manual Scan===
[[File:Zap-hud firefox.png|thumb|ZAP HUD Welcome Message]]
A manual scan can be done the following way:
* Start ZAP and click the Quick Start tab of the Workspace Window. (see above)
* Click the large Manual Explore button.
* In the URL to explore text box, enter the full URL of the web application you want to explore.
* Select the browser you would like to use
* Click the Launch Browser

Next you will be presented with a welcome message that includes the HUD tutorial (see figure "ZAP HUD Welcome Message")

=== Spider ===
[[File:Zap-spider.png|thumb|ZAP Spider]]
After running a scan the Spider tab opens up in ZAP, you can press the "New Scan" button in there and start the spidering of your target.

===Add-Ons===
There is a so-called '''Marketplace''' for ZAP where Add-ons can be found. These make it possible to extend the functionality of ZAP even further, and typically it is possible to add or remove them without restarting the ZAP application.
Usually Add-ons are assigned one of the following states:
* Release: high-quality add-on
* Beta: reasonable quality but possibly incomplete or still requires testing • Alpha: requires further development

[[File:Zap-addons.png|thumb|Manage Add-Ons]]
You can reach the marketplace by clicking on the blue-red-green squares symbol in the UI, it stands for "Manage Add-Ons".

===User Agent Settings===
If you go to ''Tools → Options → Connection'' in the ZAP GUI you can configure the Default User Agent (as in, which browser as well as operating system) that ZAP should pretend to be when connecting to websites. You may get different responses depending on this, especially older websites did have their own configurations for Internet Explorer that were unlike those for other browsers.

=== API ===
It is possible to interact with ZAP using its powerful Application Programming Interface (API), almost every feature that the GUI offers can be accessed via API and more features are being added with future versions. It also helps not only beginners that there is an [https://www.zaproxy.org/docs/api extensive documentation] for the API, giving examples for Shell script, Python and Java commands to run features.

Requests to the API are via GET and POST endpoints, responses are available in a variety of formats such as JSON, HTML and HTML but also custom formats such as HAR. The content of the response formats is always the same but the developer can select the format that best fits their use case depending on what they are looking for. There are recommendations given such as using HTML for good readability in reports, JSON or XML if one is looking to quickly parse the returned result.

It is also possible to use ZAP to scan APIs and even automate the scanning process for these API scans, using the same file formats we that we use for ZAP’s own API (JSON, etc.). However, the main problem with scanning APIs is the exploration, figuring out what to target and using which methods since most of the time browsing or spidering will not lead to useful results for APIs.

====Why is an API key required by default?====
Since ZAP can be controlled via API, we also must protect it from malicious sites or attackers that are looking to basically remotely control our ZAP installation or make changes to it. So it was decided to make the usage of an API key mandatory to hinder these attempts.

===Attack the OWASP Top 10 using ZAP===

One of the many guides found at the ZAP website is about how to attack the top 10 security threats using ZAP. The content of the following tables is taken from the [https://www.zaproxy.org/docs/guides/zapping-the-top-10/ Zapping the Top 10 Guide].

{| class="wikitable"
|+ Common Components
|-
|-
| ''Manual'' || Man-in-the-middle proxy
|-
| ''Manual'' || Manual request / resend
|-
| ''Manual'' || Scripts
|-
| ''Manual'' || Search
|}

{| class="wikitable"
|+ A1 Injection
|-
|-
| ''Automated'' || Active Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Advanced SQLInjection Scanner* (Based on SQLMap)
|-
| ''Manual'' || Fuzzer, combined with the FuzzDb* and SVN Digger* files
|}

{| class="wikitable"
|+ A2 Broken Authentication
|-
|-
| ''Manual'' || HTTP Sessions
|-
| ''Manual'' || Spider
|-
| ''Manual'' || Forced Browse
|-
| ''Manual'' || Token Generator*
|-
| ''Automatic'' || Access Control Testing*
|}

{| class="wikitable"
|+ A3 Sensitive Data Exposure
|-
|-
| ''Automated'' || Active Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Passive Scan Rules (Release, Beta*, and Alpha*)
|}

{| class="wikitable"
|+ A4 XML External Entities (XXE)
|-
| ''Automatic'' || Active Scan Rules (Release, Beta*, and Alpha*)
|}

{| class="wikitable"
|+ A5 Broken Access Control
|-
| ''Automated'' || Active Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Passive Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Access Control Testing*
|-
| ''Manual'' || HttpsInfo*
|-
| ''Manual'' || Port Scanner*
|-
| ''Manual'' || Wappalyzer - Technology detection*
|}

{| class="wikitable"
|+ A6 Security Misconfiguration
|-
|-
| ''Manual'' || Spider
|-
| ''Manual'' || Ajax Spider
|-
| ''Manual'' || Session comparison
|-
| ''Manual'' || Access Control Testing*
|-
| ''Manual'' || HttpsInfo*
|}

{| class="wikitable"
|+ A7 Cross-Site Scripting (XSS)
|-
| ''Automated'' || Active Scan Rules (Release)
|-
| ''Manual'' || Fuzzer, combined with the FuzzDb* files
|-
| ''Manual'' || Plug-n-Hack
|}

{| class="wikitable"
|+ A8 Insecure Deserialization
|-
| ''Automated'' || There are two outstanding issues that are relevant to this Top 10 entry: Insecure deserialization active scanner & Java Serialization Handling
|}

{| class="wikitable"
|+ A9 Using Components with Known Vulnerabilities
|-
| ''Automated'' || Passive Scan Rules (Alpha*) and Retire
|-
| ''Manual'' || Wappalyzer - Technology detection
|}

{| class="wikitable"
|+ A10 Insufficient Logging & Monitoring
|-
| ''Automated / Manual'' || The Spider(s), Active Scanner, Fuzzer, and Access Control addon can all be used to generate traffic and ”attacks” which are
potential sources/causes for logging and alerting.
|}

Note: Add-ons marked with a * are not part of the default installation of ZAP, they can be installed using the ZAP Marketplace

==Modes==
ZAP has different modes to to choose from:
* Safe: only allows operations that are considered not dangerous
* Protected: the officially recommended mode, it does allow dangerous operations but only on URLs that were put in the Scope of our target
* Standard: everything goes
* ATTACK: this mode sets ZAP to scan new nodes within the Scope to be actively scanned as soon as they are discovered

===Passive versus Active Scanning===
Passive scanning is considered safe and legal, too, it is used to find vulnerabilities and none of the requests or responses change. It is also run in a background thread so it does not negatively affect the performance when exploring an application.

With Active Scanning we might actually attack our target so this should be done with caution and of course permission only, we could end up altering data at the target site with an active scan.

Limitations of a standard passive scan are that pages that require a login can not be accessed by ZAP since the authentication will not be handled by ZAP. It is, however, possible to configure the functionality to authenticate. Another limitation is that the sequence in which a passive scan explores the target is pretty much uncontrollable. But ZAP offers a solution for almost every limitation, and that means there are many extra features in ZAP for exploring and attacking other than the passive scan. For exploring a site we already mentioned spidering as a viable option but we need to keep in mind that they also are rather limited when it comes to filling out forms, they may enter default data or random strings instead of the required information. So it is suggested that spidering is used in combination with manual exploration, so that an actual user can, for example, fill out form data if an error message is returned.

Another recommendation for exploration is to take a look at the web application with a browser proxying through ZAP, the benefit of this method is that all requests and responses undergo a passive scan by ZAP and a site tree is built. Additionally, ZAP will record potential vulnerabilities that it finds for future reference.

== Videos ==

A series of short videos (~10 mins each) about different ZAP features can be found both [https://www.zaproxy.org/zap-in-ten/ here] and [https://www.alldaydevops.com/zap-in-ten here].

== References ==
* [https://www.zaproxy.org/docs/ Official Documentation for ZAP]
* R. S. Devi and M. M. Kumar, "Testing for Security Weakness of Web Applications using Ethical Hacking," 2020 4th International Conference on Trends in Electronics and Informatics (ICOEI)(48184), Tirunelveli, India, 2020, pp. 354-361, doi: 10.1109/ICOEI48184.2020.9143018.[https://ieeexplore.ieee.org/document/9143018]

OWASP ZAP

2020-12-20T13:13:00Z

MMuszik: /* Manual Scan */

File:Zap-spider.png

2020-12-20T13:12:49Z

MMuszik: ZAP Spider screenshot taken by MMuzik

== Summary ==
ZAP Spider screenshot taken by MMuzik

OWASP ZAP

2020-12-20T13:02:18Z

MMuszik: /* Test target */

== Introduction ==
=== About ===
ZAP is short for Zed Attack Proxy. Before we delve into details as to what this means, what it is about, why it was created and what it can be used for, let us start by having a look at the ''principles of ZAP'' first for a better understanding.

The principles are:
* It is free, open source which means anyone can access and use it.
* It is also cross platform that is it works on Linux, Windows and Macs.
* It is easy to use; any user be it beginner or a professional can use it easily.
* It is easy to install; it requires Java Runtime Environment but everything else is included in standard downloads.
* It is fully internationalized, i.e., it has been translated to many other languages.
* It is fully documented, set of useful documents and helpline files are included.
* It works well with other tools, so that we can use other tools in conjunction with zap if we need to.
* It supports the use of well-regarded components.
These principles can be seen as the motivation behind ZAP, to summarise, it is designed to give everyone interested the chance to easily run security tests, at no cost, no matter their experience, the computer they use or the language they speak.
OWASP (Open Web Application Security Project) is a non-profit organisation that publishes freely-available articles, and aside from tools like ZAP they also provide documentation and technologies that deal with web application security. A lot of other security publications refer to the OWASP publications, for example the OWASP Top 10 which is looking at the biggest security risks for organisations and which will be featured in its own chapter in this here paper later on.
They also offer a Testing guide as well as a Development guide offering best practice information to those interested and many more interesting resources.

=== Description ===
ZAP’s focus is on testing web applications, the core idea behind it is a ”Man-in-the-Middle proxy”, that is, all web traffic between the web browser and the web application is first directed through ZAP. The data and messages can be intercepted, inspected, even modified before they are forwarded to their actual destination.
There are different ways to run ZAP, it is possible to use it as a stand-alone application (Java 8+ is required) or as a daemon process.

It is also possible to run ZAP in combination with another proxy, e.g. if a company runs their web traffic through their own proxy or firewall solution first. In this case we configure our browser to connect to ZAP, and then we can configure ZAP to connect to that other proxy.

There are various Add-ons as well as an API which make it possible to be used in a variety of scenarios and also to extend ZAP further in the future.
As stated in the principles, ZAP targets all skill levels, from those new to security testing who will probably start out by using automated tests, to developers, to those that run security tests for a living and can be considered specialists, making use of a variety of features including manual tests. The flexibility and extensibility (via add-ons in the ZAP marketplace that is part of the client) that ZAP provides make it a popular choice among security testers, add to that it is available for free and for pretty much every major operating system.
Since we’re talking about security, to a lot of people it is also important to know what their security tools really do. ZAP is open source and code examination is possible if so desired, one can look at how certain functions are implemented and the developers are transparent about which data ZAP is ”sending home” (e.g. checks for new versions), and also how that background data can be controlled or even disabled (where possible).
The ZAP community is also very open to new developers, anyone can submit bug fixes or create additional features for ZAP.

==How-To==
===Installation===
[[File:Zap-installation.png|thumb|ZAP Installation]]

First, go to the [https://www.zaproxy.org/download/ Download section on the official website for ZAP] and select the installer for your operating system.

Additionally, a Java version 8 or higher must be installed. That’s pretty much it, one needs to agree to the terms of service and then ZAP is ready to go.

=== Test target ===

If you want to try out the features of ZAP and do not want to set up your own server, you can find places like [https://public-firing-range.appspot.com/ https://public-firing-range.appspot.com/] which is a free-to-use online installation of Google's Firing Range. Do NOT run active features of ZAP against public websites without permission, you might alter data and this kind of attack can be prosecuted!

===Quickstart/Automated Scan===
[[File:Zap-persist session.png|thumb|ZAP Session Persistence]]
After opening ZAP you are asked if you want to persist the session. Answer "No" to quickly skip to the Quickstart.
[[File:Zap-quickstart.png|thumb|ZAP Quickstart]]
The easiest way to start using ZAP is via the Quick Start tab. Quick Start is a ZAP add-on that is included automatically when you installed ZAP.
To run a Quick Start Automated Scan:
* Start ZAP and click the Quick Start tab of the Workspace Window.
* Click the large Automated Scan button.
* In the URL to attack text box, enter the full URL of the web application you want to attack.
* Click the Attack button

===Manual Scan===
[[File:Zap-hud firefox.png|thumb|ZAP HUD Welcome Message]]
A manual scan can be done the following way:
* Start ZAP and click the Quick Start tab of the Workspace Window. (see above)
* Click the large Manual Explore button.
* In the URL to explore text box, enter the full URL of the web application you want to explore.
* Select the browser you would like to use
* Click the Launch Browser

Next you will be presented with a welcome message that includes the HUD tutorial (see figure "ZAP HUD Welcome Message")

===Add-Ons===
There is a so-called '''Marketplace''' for ZAP where Add-ons can be found. These make it possible to extend the functionality of ZAP even further, and typically it is possible to add or remove them without restarting the ZAP application.
Usually Add-ons are assigned one of the following states:
* Release: high-quality add-on
* Beta: reasonable quality but possibly incomplete or still requires testing • Alpha: requires further development

[[File:Zap-addons.png|thumb|Manage Add-Ons]]
You can reach the marketplace by clicking on the blue-red-green squares symbol in the UI, it stands for "Manage Add-Ons".

===User Agent Settings===
If you go to ''Tools → Options → Connection'' in the ZAP GUI you can configure the Default User Agent (as in, which browser as well as operating system) that ZAP should pretend to be when connecting to websites. You may get different responses depending on this, especially older websites did have their own configurations for Internet Explorer that were unlike those for other browsers.

=== API ===
It is possible to interact with ZAP using its powerful Application Programming Interface (API), almost every feature that the GUI offers can be accessed via API and more features are being added with future versions. It also helps not only beginners that there is an [https://www.zaproxy.org/docs/api extensive documentation] for the API, giving examples for Shell script, Python and Java commands to run features.

Requests to the API are via GET and POST endpoints, responses are available in a variety of formats such as JSON, HTML and HTML but also custom formats such as HAR. The content of the response formats is always the same but the developer can select the format that best fits their use case depending on what they are looking for. There are recommendations given such as using HTML for good readability in reports, JSON or XML if one is looking to quickly parse the returned result.

It is also possible to use ZAP to scan APIs and even automate the scanning process for these API scans, using the same file formats we that we use for ZAP’s own API (JSON, etc.). However, the main problem with scanning APIs is the exploration, figuring out what to target and using which methods since most of the time browsing or spidering will not lead to useful results for APIs.

====Why is an API key required by default?====
Since ZAP can be controlled via API, we also must protect it from malicious sites or attackers that are looking to basically remotely control our ZAP installation or make changes to it. So it was decided to make the usage of an API key mandatory to hinder these attempts.

===Attack the OWASP Top 10 using ZAP===

One of the many guides found at the ZAP website is about how to attack the top 10 security threats using ZAP. The content of the following tables is taken from the [https://www.zaproxy.org/docs/guides/zapping-the-top-10/ Zapping the Top 10 Guide].

{| class="wikitable"
|+ Common Components
|-
|-
| ''Manual'' || Man-in-the-middle proxy
|-
| ''Manual'' || Manual request / resend
|-
| ''Manual'' || Scripts
|-
| ''Manual'' || Search
|}

{| class="wikitable"
|+ A1 Injection
|-
|-
| ''Automated'' || Active Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Advanced SQLInjection Scanner* (Based on SQLMap)
|-
| ''Manual'' || Fuzzer, combined with the FuzzDb* and SVN Digger* files
|}

{| class="wikitable"
|+ A2 Broken Authentication
|-
|-
| ''Manual'' || HTTP Sessions
|-
| ''Manual'' || Spider
|-
| ''Manual'' || Forced Browse
|-
| ''Manual'' || Token Generator*
|-
| ''Automatic'' || Access Control Testing*
|}

{| class="wikitable"
|+ A3 Sensitive Data Exposure
|-
|-
| ''Automated'' || Active Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Passive Scan Rules (Release, Beta*, and Alpha*)
|}

{| class="wikitable"
|+ A4 XML External Entities (XXE)
|-
| ''Automatic'' || Active Scan Rules (Release, Beta*, and Alpha*)
|}

{| class="wikitable"
|+ A5 Broken Access Control
|-
| ''Automated'' || Active Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Passive Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Access Control Testing*
|-
| ''Manual'' || HttpsInfo*
|-
| ''Manual'' || Port Scanner*
|-
| ''Manual'' || Wappalyzer - Technology detection*
|}

{| class="wikitable"
|+ A6 Security Misconfiguration
|-
|-
| ''Manual'' || Spider
|-
| ''Manual'' || Ajax Spider
|-
| ''Manual'' || Session comparison
|-
| ''Manual'' || Access Control Testing*
|-
| ''Manual'' || HttpsInfo*
|}

{| class="wikitable"
|+ A7 Cross-Site Scripting (XSS)
|-
| ''Automated'' || Active Scan Rules (Release)
|-
| ''Manual'' || Fuzzer, combined with the FuzzDb* files
|-
| ''Manual'' || Plug-n-Hack
|}

{| class="wikitable"
|+ A8 Insecure Deserialization
|-
| ''Automated'' || There are two outstanding issues that are relevant to this Top 10 entry: Insecure deserialization active scanner & Java Serialization Handling
|}

{| class="wikitable"
|+ A9 Using Components with Known Vulnerabilities
|-
| ''Automated'' || Passive Scan Rules (Alpha*) and Retire
|-
| ''Manual'' || Wappalyzer - Technology detection
|}

{| class="wikitable"
|+ A10 Insufficient Logging & Monitoring
|-
| ''Automated / Manual'' || The Spider(s), Active Scanner, Fuzzer, and Access Control addon can all be used to generate traffic and ”attacks” which are
potential sources/causes for logging and alerting.
|}

Note: Add-ons marked with a * are not part of the default installation of ZAP, they can be installed using the ZAP Marketplace

==Modes==
ZAP has different modes to to choose from:
* Safe: only allows operations that are considered not dangerous
* Protected: the officially recommended mode, it does allow dangerous operations but only on URLs that were put in the Scope of our target
* Standard: everything goes
* ATTACK: this mode sets ZAP to scan new nodes within the Scope to be actively scanned as soon as they are discovered

===Passive versus Active Scanning===
Passive scanning is considered safe and legal, too, it is used to find vulnerabilities and none of the requests or responses change. It is also run in a background thread so it does not negatively affect the performance when exploring an application.

With Active Scanning we might actually attack our target so this should be done with caution and of course permission only, we could end up altering data at the target site with an active scan.

Limitations of a standard passive scan are that pages that require a login can not be accessed by ZAP since the authentication will not be handled by ZAP. It is, however, possible to configure the functionality to authenticate. Another limitation is that the sequence in which a passive scan explores the target is pretty much uncontrollable. But ZAP offers a solution for almost every limitation, and that means there are many extra features in ZAP for exploring and attacking other than the passive scan. For exploring a site we already mentioned spidering as a viable option but we need to keep in mind that they also are rather limited when it comes to filling out forms, they may enter default data or random strings instead of the required information. So it is suggested that spidering is used in combination with manual exploration, so that an actual user can, for example, fill out form data if an error message is returned.

Another recommendation for exploration is to take a look at the web application with a browser proxying through ZAP, the benefit of this method is that all requests and responses undergo a passive scan by ZAP and a site tree is built. Additionally, ZAP will record potential vulnerabilities that it finds for future reference.

== Videos ==

A series of short videos (~10 mins each) about different ZAP features can be found both [https://www.zaproxy.org/zap-in-ten/ here] and [https://www.alldaydevops.com/zap-in-ten here].

OWASP ZAP

2020-12-20T13:02:02Z

MMuszik: /* How-To */

== Introduction ==
=== About ===
ZAP is short for Zed Attack Proxy. Before we delve into details as to what this means, what it is about, why it was created and what it can be used for, let us start by having a look at the ''principles of ZAP'' first for a better understanding.

The principles are:
* It is free, open source which means anyone can access and use it.
* It is also cross platform that is it works on Linux, Windows and Macs.
* It is easy to use; any user be it beginner or a professional can use it easily.
* It is easy to install; it requires Java Runtime Environment but everything else is included in standard downloads.
* It is fully internationalized, i.e., it has been translated to many other languages.
* It is fully documented, set of useful documents and helpline files are included.
* It works well with other tools, so that we can use other tools in conjunction with zap if we need to.
* It supports the use of well-regarded components.
These principles can be seen as the motivation behind ZAP, to summarise, it is designed to give everyone interested the chance to easily run security tests, at no cost, no matter their experience, the computer they use or the language they speak.
OWASP (Open Web Application Security Project) is a non-profit organisation that publishes freely-available articles, and aside from tools like ZAP they also provide documentation and technologies that deal with web application security. A lot of other security publications refer to the OWASP publications, for example the OWASP Top 10 which is looking at the biggest security risks for organisations and which will be featured in its own chapter in this here paper later on.
They also offer a Testing guide as well as a Development guide offering best practice information to those interested and many more interesting resources.

=== Description ===
ZAP’s focus is on testing web applications, the core idea behind it is a ”Man-in-the-Middle proxy”, that is, all web traffic between the web browser and the web application is first directed through ZAP. The data and messages can be intercepted, inspected, even modified before they are forwarded to their actual destination.
There are different ways to run ZAP, it is possible to use it as a stand-alone application (Java 8+ is required) or as a daemon process.

It is also possible to run ZAP in combination with another proxy, e.g. if a company runs their web traffic through their own proxy or firewall solution first. In this case we configure our browser to connect to ZAP, and then we can configure ZAP to connect to that other proxy.

There are various Add-ons as well as an API which make it possible to be used in a variety of scenarios and also to extend ZAP further in the future.
As stated in the principles, ZAP targets all skill levels, from those new to security testing who will probably start out by using automated tests, to developers, to those that run security tests for a living and can be considered specialists, making use of a variety of features including manual tests. The flexibility and extensibility (via add-ons in the ZAP marketplace that is part of the client) that ZAP provides make it a popular choice among security testers, add to that it is available for free and for pretty much every major operating system.
Since we’re talking about security, to a lot of people it is also important to know what their security tools really do. ZAP is open source and code examination is possible if so desired, one can look at how certain functions are implemented and the developers are transparent about which data ZAP is ”sending home” (e.g. checks for new versions), and also how that background data can be controlled or even disabled (where possible).
The ZAP community is also very open to new developers, anyone can submit bug fixes or create additional features for ZAP.

==How-To==
===Installation===
[[File:Zap-installation.png|thumb|ZAP Installation]]

First, go to the [https://www.zaproxy.org/download/ Download section on the official website for ZAP] and select the installer for your operating system.

Additionally, a Java version 8 or higher must be installed. That’s pretty much it, one needs to agree to the terms of service and then ZAP is ready to go.

== Test target ==

If you want to try out the features of ZAP and do not want to set up your own server, you can find places like [https://public-firing-range.appspot.com/ https://public-firing-range.appspot.com/] which is a free-to-use online installation of Google's Firing Range. Do NOT run active features of ZAP against public websites without permission, you might alter data and this kind of attack can be prosecuted!

===Quickstart/Automated Scan===
[[File:Zap-persist session.png|thumb|ZAP Session Persistence]]
After opening ZAP you are asked if you want to persist the session. Answer "No" to quickly skip to the Quickstart.
[[File:Zap-quickstart.png|thumb|ZAP Quickstart]]
The easiest way to start using ZAP is via the Quick Start tab. Quick Start is a ZAP add-on that is included automatically when you installed ZAP.
To run a Quick Start Automated Scan:
* Start ZAP and click the Quick Start tab of the Workspace Window.
* Click the large Automated Scan button.
* In the URL to attack text box, enter the full URL of the web application you want to attack.
* Click the Attack button

===Manual Scan===
[[File:Zap-hud firefox.png|thumb|ZAP HUD Welcome Message]]
A manual scan can be done the following way:
* Start ZAP and click the Quick Start tab of the Workspace Window. (see above)
* Click the large Manual Explore button.
* In the URL to explore text box, enter the full URL of the web application you want to explore.
* Select the browser you would like to use
* Click the Launch Browser

Next you will be presented with a welcome message that includes the HUD tutorial (see figure "ZAP HUD Welcome Message")

===Add-Ons===
There is a so-called '''Marketplace''' for ZAP where Add-ons can be found. These make it possible to extend the functionality of ZAP even further, and typically it is possible to add or remove them without restarting the ZAP application.
Usually Add-ons are assigned one of the following states:
* Release: high-quality add-on
* Beta: reasonable quality but possibly incomplete or still requires testing • Alpha: requires further development

[[File:Zap-addons.png|thumb|Manage Add-Ons]]
You can reach the marketplace by clicking on the blue-red-green squares symbol in the UI, it stands for "Manage Add-Ons".

===User Agent Settings===
If you go to ''Tools → Options → Connection'' in the ZAP GUI you can configure the Default User Agent (as in, which browser as well as operating system) that ZAP should pretend to be when connecting to websites. You may get different responses depending on this, especially older websites did have their own configurations for Internet Explorer that were unlike those for other browsers.

=== API ===
It is possible to interact with ZAP using its powerful Application Programming Interface (API), almost every feature that the GUI offers can be accessed via API and more features are being added with future versions. It also helps not only beginners that there is an [https://www.zaproxy.org/docs/api extensive documentation] for the API, giving examples for Shell script, Python and Java commands to run features.

Requests to the API are via GET and POST endpoints, responses are available in a variety of formats such as JSON, HTML and HTML but also custom formats such as HAR. The content of the response formats is always the same but the developer can select the format that best fits their use case depending on what they are looking for. There are recommendations given such as using HTML for good readability in reports, JSON or XML if one is looking to quickly parse the returned result.

It is also possible to use ZAP to scan APIs and even automate the scanning process for these API scans, using the same file formats we that we use for ZAP’s own API (JSON, etc.). However, the main problem with scanning APIs is the exploration, figuring out what to target and using which methods since most of the time browsing or spidering will not lead to useful results for APIs.

====Why is an API key required by default?====
Since ZAP can be controlled via API, we also must protect it from malicious sites or attackers that are looking to basically remotely control our ZAP installation or make changes to it. So it was decided to make the usage of an API key mandatory to hinder these attempts.

===Attack the OWASP Top 10 using ZAP===

One of the many guides found at the ZAP website is about how to attack the top 10 security threats using ZAP. The content of the following tables is taken from the [https://www.zaproxy.org/docs/guides/zapping-the-top-10/ Zapping the Top 10 Guide].

{| class="wikitable"
|+ Common Components
|-
|-
| ''Manual'' || Man-in-the-middle proxy
|-
| ''Manual'' || Manual request / resend
|-
| ''Manual'' || Scripts
|-
| ''Manual'' || Search
|}

{| class="wikitable"
|+ A1 Injection
|-
|-
| ''Automated'' || Active Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Advanced SQLInjection Scanner* (Based on SQLMap)
|-
| ''Manual'' || Fuzzer, combined with the FuzzDb* and SVN Digger* files
|}

{| class="wikitable"
|+ A2 Broken Authentication
|-
|-
| ''Manual'' || HTTP Sessions
|-
| ''Manual'' || Spider
|-
| ''Manual'' || Forced Browse
|-
| ''Manual'' || Token Generator*
|-
| ''Automatic'' || Access Control Testing*
|}

{| class="wikitable"
|+ A3 Sensitive Data Exposure
|-
|-
| ''Automated'' || Active Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Passive Scan Rules (Release, Beta*, and Alpha*)
|}

{| class="wikitable"
|+ A4 XML External Entities (XXE)
|-
| ''Automatic'' || Active Scan Rules (Release, Beta*, and Alpha*)
|}

{| class="wikitable"
|+ A5 Broken Access Control
|-
| ''Automated'' || Active Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Passive Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Access Control Testing*
|-
| ''Manual'' || HttpsInfo*
|-
| ''Manual'' || Port Scanner*
|-
| ''Manual'' || Wappalyzer - Technology detection*
|}

{| class="wikitable"
|+ A6 Security Misconfiguration
|-
|-
| ''Manual'' || Spider
|-
| ''Manual'' || Ajax Spider
|-
| ''Manual'' || Session comparison
|-
| ''Manual'' || Access Control Testing*
|-
| ''Manual'' || HttpsInfo*
|}

{| class="wikitable"
|+ A7 Cross-Site Scripting (XSS)
|-
| ''Automated'' || Active Scan Rules (Release)
|-
| ''Manual'' || Fuzzer, combined with the FuzzDb* files
|-
| ''Manual'' || Plug-n-Hack
|}

{| class="wikitable"
|+ A8 Insecure Deserialization
|-
| ''Automated'' || There are two outstanding issues that are relevant to this Top 10 entry: Insecure deserialization active scanner & Java Serialization Handling
|}

{| class="wikitable"
|+ A9 Using Components with Known Vulnerabilities
|-
| ''Automated'' || Passive Scan Rules (Alpha*) and Retire
|-
| ''Manual'' || Wappalyzer - Technology detection
|}

{| class="wikitable"
|+ A10 Insufficient Logging & Monitoring
|-
| ''Automated / Manual'' || The Spider(s), Active Scanner, Fuzzer, and Access Control addon can all be used to generate traffic and ”attacks” which are
potential sources/causes for logging and alerting.
|}

Note: Add-ons marked with a * are not part of the default installation of ZAP, they can be installed using the ZAP Marketplace

==Modes==
ZAP has different modes to to choose from:
* Safe: only allows operations that are considered not dangerous
* Protected: the officially recommended mode, it does allow dangerous operations but only on URLs that were put in the Scope of our target
* Standard: everything goes
* ATTACK: this mode sets ZAP to scan new nodes within the Scope to be actively scanned as soon as they are discovered

===Passive versus Active Scanning===
Passive scanning is considered safe and legal, too, it is used to find vulnerabilities and none of the requests or responses change. It is also run in a background thread so it does not negatively affect the performance when exploring an application.

With Active Scanning we might actually attack our target so this should be done with caution and of course permission only, we could end up altering data at the target site with an active scan.

Limitations of a standard passive scan are that pages that require a login can not be accessed by ZAP since the authentication will not be handled by ZAP. It is, however, possible to configure the functionality to authenticate. Another limitation is that the sequence in which a passive scan explores the target is pretty much uncontrollable. But ZAP offers a solution for almost every limitation, and that means there are many extra features in ZAP for exploring and attacking other than the passive scan. For exploring a site we already mentioned spidering as a viable option but we need to keep in mind that they also are rather limited when it comes to filling out forms, they may enter default data or random strings instead of the required information. So it is suggested that spidering is used in combination with manual exploration, so that an actual user can, for example, fill out form data if an error message is returned.

Another recommendation for exploration is to take a look at the web application with a browser proxying through ZAP, the benefit of this method is that all requests and responses undergo a passive scan by ZAP and a site tree is built. Additionally, ZAP will record potential vulnerabilities that it finds for future reference.

== Videos ==

A series of short videos (~10 mins each) about different ZAP features can be found both [https://www.zaproxy.org/zap-in-ten/ here] and [https://www.alldaydevops.com/zap-in-ten here].

OWASP ZAP

2020-12-20T12:58:12Z

MMuszik:

== Introduction ==
=== About ===
ZAP is short for Zed Attack Proxy. Before we delve into details as to what this means, what it is about, why it was created and what it can be used for, let us start by having a look at the ''principles of ZAP'' first for a better understanding.

The principles are:
* It is free, open source which means anyone can access and use it.
* It is also cross platform that is it works on Linux, Windows and Macs.
* It is easy to use; any user be it beginner or a professional can use it easily.
* It is easy to install; it requires Java Runtime Environment but everything else is included in standard downloads.
* It is fully internationalized, i.e., it has been translated to many other languages.
* It is fully documented, set of useful documents and helpline files are included.
* It works well with other tools, so that we can use other tools in conjunction with zap if we need to.
* It supports the use of well-regarded components.
These principles can be seen as the motivation behind ZAP, to summarise, it is designed to give everyone interested the chance to easily run security tests, at no cost, no matter their experience, the computer they use or the language they speak.
OWASP (Open Web Application Security Project) is a non-profit organisation that publishes freely-available articles, and aside from tools like ZAP they also provide documentation and technologies that deal with web application security. A lot of other security publications refer to the OWASP publications, for example the OWASP Top 10 which is looking at the biggest security risks for organisations and which will be featured in its own chapter in this here paper later on.
They also offer a Testing guide as well as a Development guide offering best practice information to those interested and many more interesting resources.

=== Description ===
ZAP’s focus is on testing web applications, the core idea behind it is a ”Man-in-the-Middle proxy”, that is, all web traffic between the web browser and the web application is first directed through ZAP. The data and messages can be intercepted, inspected, even modified before they are forwarded to their actual destination.
There are different ways to run ZAP, it is possible to use it as a stand-alone application (Java 8+ is required) or as a daemon process.

It is also possible to run ZAP in combination with another proxy, e.g. if a company runs their web traffic through their own proxy or firewall solution first. In this case we configure our browser to connect to ZAP, and then we can configure ZAP to connect to that other proxy.

There are various Add-ons as well as an API which make it possible to be used in a variety of scenarios and also to extend ZAP further in the future.
As stated in the principles, ZAP targets all skill levels, from those new to security testing who will probably start out by using automated tests, to developers, to those that run security tests for a living and can be considered specialists, making use of a variety of features including manual tests. The flexibility and extensibility (via add-ons in the ZAP marketplace that is part of the client) that ZAP provides make it a popular choice among security testers, add to that it is available for free and for pretty much every major operating system.
Since we’re talking about security, to a lot of people it is also important to know what their security tools really do. ZAP is open source and code examination is possible if so desired, one can look at how certain functions are implemented and the developers are transparent about which data ZAP is ”sending home” (e.g. checks for new versions), and also how that background data can be controlled or even disabled (where possible).
The ZAP community is also very open to new developers, anyone can submit bug fixes or create additional features for ZAP.

==How-To==
===Installation===
[[File:Zap-installation.png|thumb|ZAP Installation]]

First, go to the [https://www.zaproxy.org/download/ Download section on the official website for ZAP] and select the installer for your operating system.

Additionally, a Java version 8 or higher must be installed. That’s pretty much it, one needs to agree to the terms of service and then ZAP is ready to go.

===Quickstart/Automated Scan===
[[File:Zap-persist session.png|thumb|ZAP Session Persistence]]
After opening ZAP you are asked if you want to persist the session. Answer "No" to quickly skip to the Quickstart.
[[File:Zap-quickstart.png|thumb|ZAP Quickstart]]
The easiest way to start using ZAP is via the Quick Start tab. Quick Start is a ZAP add-on that is included automatically when you installed ZAP.
To run a Quick Start Automated Scan:
* Start ZAP and click the Quick Start tab of the Workspace Window.
* Click the large Automated Scan button.
* In the URL to attack text box, enter the full URL of the web application you want to attack.
* Click the Attack button

===Manual Scan===
[[File:Zap-hud firefox.png|thumb|ZAP HUD Welcome Message]]
A manual scan can be done the following way:
* Start ZAP and click the Quick Start tab of the Workspace Window. (see above)
* Click the large Manual Explore button.
* In the URL to explore text box, enter the full URL of the web application you want to explore.
* Select the browser you would like to use
* Click the Launch Browser

Next you will be presented with a welcome message that includes the HUD tutorial (see figure "ZAP HUD Welcome Message")

===Add-Ons===
There is a so-called '''Marketplace''' for ZAP where Add-ons can be found. These make it possible to extend the functionality of ZAP even further, and typically it is possible to add or remove them without restarting the ZAP application.
Usually Add-ons are assigned one of the following states:
* Release: high-quality add-on
* Beta: reasonable quality but possibly incomplete or still requires testing • Alpha: requires further development

[[File:Zap-addons.png|thumb|Manage Add-Ons]]
You can reach the marketplace by clicking on the blue-red-green squares symbol in the UI, it stands for "Manage Add-Ons".

===User Agent Settings===
If you go to ''Tools → Options → Connection'' in the ZAP GUI you can configure the Default User Agent (as in, which browser as well as operating system) that ZAP should pretend to be when connecting to websites. You may get different responses depending on this, especially older websites did have their own configurations for Internet Explorer that were unlike those for other browsers.

=== API ===
It is possible to interact with ZAP using its powerful Application Programming Interface (API), almost every feature that the GUI offers can be accessed via API and more features are being added with future versions. It also helps not only beginners that there is an [https://www.zaproxy.org/docs/api extensive documentation] for the API, giving examples for Shell script, Python and Java commands to run features.

Requests to the API are via GET and POST endpoints, responses are available in a variety of formats such as JSON, HTML and HTML but also custom formats such as HAR. The content of the response formats is always the same but the developer can select the format that best fits their use case depending on what they are looking for. There are recommendations given such as using HTML for good readability in reports, JSON or XML if one is looking to quickly parse the returned result.

It is also possible to use ZAP to scan APIs and even automate the scanning process for these API scans, using the same file formats we that we use for ZAP’s own API (JSON, etc.). However, the main problem with scanning APIs is the exploration, figuring out what to target and using which methods since most of the time browsing or spidering will not lead to useful results for APIs.

====Why is an API key required by default?====
Since ZAP can be controlled via API, we also must protect it from malicious sites or attackers that are looking to basically remotely control our ZAP installation or make changes to it. So it was decided to make the usage of an API key mandatory to hinder these attempts.

===Attack the OWASP Top 10 using ZAP===

One of the many guides found at the ZAP website is about how to attack the top 10 security threats using ZAP. The content of the following tables is taken from the [https://www.zaproxy.org/docs/guides/zapping-the-top-10/ Zapping the Top 10 Guide].

{| class="wikitable"
|+ Common Components
|-
|-
| ''Manual'' || Man-in-the-middle proxy
|-
| ''Manual'' || Manual request / resend
|-
| ''Manual'' || Scripts
|-
| ''Manual'' || Search
|}

{| class="wikitable"
|+ A1 Injection
|-
|-
| ''Automated'' || Active Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Advanced SQLInjection Scanner* (Based on SQLMap)
|-
| ''Manual'' || Fuzzer, combined with the FuzzDb* and SVN Digger* files
|}

{| class="wikitable"
|+ A2 Broken Authentication
|-
|-
| ''Manual'' || HTTP Sessions
|-
| ''Manual'' || Spider
|-
| ''Manual'' || Forced Browse
|-
| ''Manual'' || Token Generator*
|-
| ''Automatic'' || Access Control Testing*
|}

{| class="wikitable"
|+ A3 Sensitive Data Exposure
|-
|-
| ''Automated'' || Active Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Passive Scan Rules (Release, Beta*, and Alpha*)
|}

{| class="wikitable"
|+ A4 XML External Entities (XXE)
|-
| ''Automatic'' || Active Scan Rules (Release, Beta*, and Alpha*)
|}

{| class="wikitable"
|+ A5 Broken Access Control
|-
| ''Automated'' || Active Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Passive Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Access Control Testing*
|-
| ''Manual'' || HttpsInfo*
|-
| ''Manual'' || Port Scanner*
|-
| ''Manual'' || Wappalyzer - Technology detection*
|}

{| class="wikitable"
|+ A6 Security Misconfiguration
|-
|-
| ''Manual'' || Spider
|-
| ''Manual'' || Ajax Spider
|-
| ''Manual'' || Session comparison
|-
| ''Manual'' || Access Control Testing*
|-
| ''Manual'' || HttpsInfo*
|}

{| class="wikitable"
|+ A7 Cross-Site Scripting (XSS)
|-
| ''Automated'' || Active Scan Rules (Release)
|-
| ''Manual'' || Fuzzer, combined with the FuzzDb* files
|-
| ''Manual'' || Plug-n-Hack
|}

{| class="wikitable"
|+ A8 Insecure Deserialization
|-
| ''Automated'' || There are two outstanding issues that are relevant to this Top 10 entry: Insecure deserialization active scanner & Java Serialization Handling
|}

{| class="wikitable"
|+ A9 Using Components with Known Vulnerabilities
|-
| ''Automated'' || Passive Scan Rules (Alpha*) and Retire
|-
| ''Manual'' || Wappalyzer - Technology detection
|}

{| class="wikitable"
|+ A10 Insufficient Logging & Monitoring
|-
| ''Automated / Manual'' || The Spider(s), Active Scanner, Fuzzer, and Access Control addon can all be used to generate traffic and ”attacks” which are
potential sources/causes for logging and alerting.
|}

Note: Add-ons marked with a * are not part of the default installation of ZAP, they can be installed using the ZAP Marketplace

==Modes==
ZAP has different modes to to choose from:
* Safe: only allows operations that are considered not dangerous
* Protected: the officially recommended mode, it does allow dangerous operations but only on URLs that were put in the Scope of our target
* Standard: everything goes
* ATTACK: this mode sets ZAP to scan new nodes within the Scope to be actively scanned as soon as they are discovered

===Passive versus Active Scanning===
Passive scanning is considered safe and legal, too, it is used to find vulnerabilities and none of the requests or responses change. It is also run in a background thread so it does not negatively affect the performance when exploring an application.

With Active Scanning we might actually attack our target so this should be done with caution and of course permission only, we could end up altering data at the target site with an active scan.

Limitations of a standard passive scan are that pages that require a login can not be accessed by ZAP since the authentication will not be handled by ZAP. It is, however, possible to configure the functionality to authenticate. Another limitation is that the sequence in which a passive scan explores the target is pretty much uncontrollable. But ZAP offers a solution for almost every limitation, and that means there are many extra features in ZAP for exploring and attacking other than the passive scan. For exploring a site we already mentioned spidering as a viable option but we need to keep in mind that they also are rather limited when it comes to filling out forms, they may enter default data or random strings instead of the required information. So it is suggested that spidering is used in combination with manual exploration, so that an actual user can, for example, fill out form data if an error message is returned.

Another recommendation for exploration is to take a look at the web application with a browser proxying through ZAP, the benefit of this method is that all requests and responses undergo a passive scan by ZAP and a site tree is built. Additionally, ZAP will record potential vulnerabilities that it finds for future reference.

== Videos ==

A series of short videos (~10 mins each) about different ZAP features can be found both [https://www.zaproxy.org/zap-in-ten/ here] and [https://www.alldaydevops.com/zap-in-ten here].

OWASP ZAP

2020-12-20T12:56:15Z

MMuszik: /* Manual Scan */

== Introduction ==
=== About ===
ZAP is short for Zed Attack Proxy. Before we delve into details as to what this means, what it is about, why it was created and what it can be used for, let us start by having a look at the ''principles of ZAP'' first for a better understanding.

The principles are:
* It is free, open source which means anyone can access and use it.
* It is also cross platform that is it works on Linux, Windows and Macs.
* It is easy to use; any user be it beginner or a professional can use it easily.
* It is easy to install; it requires Java Runtime Environment but everything else is included in standard downloads.
* It is fully internationalized, i.e., it has been translated to many other languages.
* It is fully documented, set of useful documents and helpline files are included.
* It works well with other tools, so that we can use other tools in conjunction with zap if we need to.
* It supports the use of well-regarded components.
These principles can be seen as the motivation behind ZAP, to summarise, it is designed to give everyone interested the chance to easily run security tests, at no cost, no matter their experience, the computer they use or the language they speak.
OWASP (Open Web Application Security Project) is a non-profit organisation that publishes freely-available articles, and aside from tools like ZAP they also provide documentation and technologies that deal with web application security. A lot of other security publications refer to the OWASP publications, for example the OWASP Top 10 which is looking at the biggest security risks for organisations and which will be featured in its own chapter in this here paper later on.
They also offer a Testing guide as well as a Development guide offering best practice information to those interested and many more interesting resources.

=== Description ===
ZAP’s focus is on testing web applications, the core idea behind it is a ”Man-in-the-Middle proxy”, that is, all web traffic between the web browser and the web application is first directed through ZAP. The data and messages can be intercepted, inspected, even modified before they are forwarded to their actual destination.
There are different ways to run ZAP, it is possible to use it as a stand-alone application (Java 8+ is required) or as a daemon process.

It is also possible to run ZAP in combination with another proxy, e.g. if a company runs their web traffic through their own proxy or firewall solution first. In this case we configure our browser to connect to ZAP, and then we can configure ZAP to connect to that other proxy.

There are various Add-ons as well as an API which make it possible to be used in a variety of scenarios and also to extend ZAP further in the future.
As stated in the principles, ZAP targets all skill levels, from those new to security testing who will probably start out by using automated tests, to developers, to those that run security tests for a living and can be considered specialists, making use of a variety of features including manual tests. The flexibility and extensibility (via add-ons in the ZAP marketplace that is part of the client) that ZAP provides make it a popular choice among security testers, add to that it is available for free and for pretty much every major operating system.
Since we’re talking about security, to a lot of people it is also important to know what their security tools really do. ZAP is open source and code examination is possible if so desired, one can look at how certain functions are implemented and the developers are transparent about which data ZAP is ”sending home” (e.g. checks for new versions), and also how that background data can be controlled or even disabled (where possible).
The ZAP community is also very open to new developers, anyone can submit bug fixes or create additional features for ZAP.

==How-To==
===Installation===
[[File:Zap-installation.png|thumb|ZAP Installation]]

First, go to the [https://www.zaproxy.org/download/ Download section on the official website for ZAP] and select the installer for your operating system.

Additionally, a Java version 8 or higher must be installed. That’s pretty much it, one needs to agree to the terms of service and then ZAP is ready to go.

===Quickstart/Automated Scan===
[[File:Zap-persist session.png|thumb|ZAP Session Persistence]]
After opening ZAP you are asked if you want to persist the session. Answer "No" to quickly skip to the Quickstart.
[[File:Zap-quickstart.png|thumb|ZAP Quickstart]]
The easiest way to start using ZAP is via the Quick Start tab. Quick Start is a ZAP add-on that is included automatically when you installed ZAP.
To run a Quick Start Automated Scan:
* Start ZAP and click the Quick Start tab of the Workspace Window.
* Click the large Automated Scan button.
* In the URL to attack text box, enter the full URL of the web application you want to attack.
* Click the Attack button

===Manual Scan===
[[File:Zap-hud firefox.png|thumb|ZAP HUD Welcome Message]]
A manual scan can be done the following way:
* Start ZAP and click the Quick Start tab of the Workspace Window. (see above)
* Click the large Manual Explore button.
* In the URL to explore text box, enter the full URL of the web application you want to explore.
* Select the browser you would like to use
* Click the Launch Browser

Next you will be presented with a welcome message that includes the HUD tutorial (see figure "ZAP HUD Welcome Message")

===Add-Ons===
There is a so-called '''Marketplace''' for ZAP where Add-ons can be found. These make it possible to extend the functionality of ZAP even further, and typically it is possible to add or remove them without restarting the ZAP application.
Usually Add-ons are assigned one of the following states:
* Release: high-quality add-on
* Beta: reasonable quality but possibly incomplete or still requires testing • Alpha: requires further development

[[File:Zap-addons.png|thumb|Manage Add-Ons]]
You can reach the marketplace by clicking on the blue-red-green squares symbol in the UI, it stands for "Manage Add-Ons".

===User Agent Settings===
If you go to ''Tools → Options → Connection'' in the ZAP GUI you can configure the Default User Agent (as in, which browser as well as operating system) that ZAP should pretend to be when connecting to websites. You may get different responses depending on this, especially older websites did have their own configurations for Internet Explorer that were unlike those for other browsers.

=== API ===
It is possible to interact with ZAP using its powerful Application Programming Interface (API), almost every feature that the GUI offers can be accessed via API and more features are being added with future versions. It also helps not only beginners that there is an [https://www.zaproxy.org/docs/api extensive documentation] for the API, giving examples for Shell script, Python and Java commands to run features.

Requests to the API are via GET and POST endpoints, responses are available in a variety of formats such as JSON, HTML and HTML but also custom formats such as HAR. The content of the response formats is always the same but the developer can select the format that best fits their use case depending on what they are looking for. There are recommendations given such as using HTML for good readability in reports, JSON or XML if one is looking to quickly parse the returned result.

It is also possible to use ZAP to scan APIs and even automate the scanning process for these API scans, using the same file formats we that we use for ZAP’s own API (JSON, etc.). However, the main problem with scanning APIs is the exploration, figuring out what to target and using which methods since most of the time browsing or spidering will not lead to useful results for APIs.

====Why is an API key required by default?====
Since ZAP can be controlled via API, we also must protect it from malicious sites or attackers that are looking to basically remotely control our ZAP installation or make changes to it. So it was decided to make the usage of an API key mandatory to hinder these attempts.

===Attack the OWASP Top 10 using ZAP===

One of the many guides found at the ZAP website is about how to attack the top 10 security threats using ZAP. The content of the following tables is taken from the [https://www.zaproxy.org/docs/guides/zapping-the-top-10/ Zapping the Top 10 Guide].

{| class="wikitable"
|+ Common Components
|-
|-
| ''Manual'' || Man-in-the-middle proxy
|-
| ''Manual'' || Manual request / resend
|-
| ''Manual'' || Scripts
|-
| ''Manual'' || Search
|}

{| class="wikitable"
|+ A1 Injection
|-
|-
| ''Automated'' || Active Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Advanced SQLInjection Scanner* (Based on SQLMap)
|-
| ''Manual'' || Fuzzer, combined with the FuzzDb* and SVN Digger* files
|}

{| class="wikitable"
|+ A2 Broken Authentication
|-
|-
| ''Manual'' || HTTP Sessions
|-
| ''Manual'' || Spider
|-
| ''Manual'' || Forced Browse
|-
| ''Manual'' || Token Generator*
|-
| ''Automatic'' || Access Control Testing*
|}

{| class="wikitable"
|+ A3 Sensitive Data Exposure
|-
|-
| ''Automated'' || Active Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Passive Scan Rules (Release, Beta*, and Alpha*)
|}

{| class="wikitable"
|+ A4 XML External Entities (XXE)
|-
| ''Automatic'' || Active Scan Rules (Release, Beta*, and Alpha*)
|}

{| class="wikitable"
|+ A5 Broken Access Control
|-
| ''Automated'' || Active Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Passive Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Access Control Testing*
|-
| ''Manual'' || HttpsInfo*
|-
| ''Manual'' || Port Scanner*
|-
| ''Manual'' || Wappalyzer - Technology detection*
|}

{| class="wikitable"
|+ A6 Security Misconfiguration
|-
|-
| ''Manual'' || Spider
|-
| ''Manual'' || Ajax Spider
|-
| ''Manual'' || Session comparison
|-
| ''Manual'' || Access Control Testing*
|-
| ''Manual'' || HttpsInfo*
|}

{| class="wikitable"
|+ A7 Cross-Site Scripting (XSS)
|-
| ''Automated'' || Active Scan Rules (Release)
|-
| ''Manual'' || Fuzzer, combined with the FuzzDb* files
|-
| ''Manual'' || Plug-n-Hack
|}

{| class="wikitable"
|+ A8 Insecure Deserialization
|-
| ''Automated'' || There are two outstanding issues that are relevant to this Top 10 entry: Insecure deserialization active scanner & Java Serialization Handling
|}

{| class="wikitable"
|+ A9 Using Components with Known Vulnerabilities
|-
| ''Automated'' || Passive Scan Rules (Alpha*) and Retire
|-
| ''Manual'' || Wappalyzer - Technology detection
|}

{| class="wikitable"
|+ A10 Insufficient Logging & Monitoring
|-
| ''Automated / Manual'' || The Spider(s), Active Scanner, Fuzzer, and Access Control addon can all be used to generate traffic and ”attacks” which are
potential sources/causes for logging and alerting.
|}

Note: Add-ons marked with a * are not part of the default installation of ZAP, they can be installed using the ZAP Marketplace

==Modes==
ZAP has different modes to to choose from:
* Safe: only allows operations that are considered not dangerous
* Protected: the officially recommended mode, it does allow dangerous operations but only on URLs that were put in the Scope of our target
* Standard: everything goes
* ATTACK: this mode sets ZAP to scan new nodes within the Scope to be actively scanned as soon as they are discovered

===Passive versus Active Scanning===
Passive scanning is considered safe and legal, too, it is used to find vulnerabilities and none of the requests or responses change. It is also run in a background thread so it does not negatively affect the performance when exploring an application.

With Active Scanning we might actually attack our target so this should be done with caution and of course permission only, we could end up altering data at the target site with an active scan.

Limitations of a standard passive scan are that pages that require a login can not be accessed by ZAP since the authentication will not be handled by ZAP. It is, however, possible to configure the functionality to authenticate. Another limitation is that the sequence in which a passive scan explores the target is pretty much uncontrollable. But ZAP offers a solution for almost every limitation, and that means there are many extra features in ZAP for exploring and attacking other than the passive scan. For exploring a site we already mentioned spidering as a viable option but we need to keep in mind that they also are rather limited when it comes to filling out forms, they may enter default data or random strings instead of the required information. So it is suggested that spidering is used in combination with manual exploration, so that an actual user can, for example, fill out form data if an error message is returned.

Another recommendation for exploration is to take a look at the web application with a browser proxying through ZAP, the benefit of this method is that all requests and responses undergo a passive scan by ZAP and a site tree is built. Additionally, ZAP will record potential vulnerabilities that it finds for future reference.

OWASP ZAP

2020-12-18T13:28:45Z

MMuszik: /* Attack the OWASP Top 10 using ZAP */

== Introduction ==
=== About ===
ZAP is short for Zed Attack Proxy. Before we delve into details as to what this means, what it is about, why it was created and what it can be used for, let us start by having a look at the ''principles of ZAP'' first for a better understanding.

The principles are:
* It is free, open source which means anyone can access and use it.
* It is also cross platform that is it works on Linux, Windows and Macs.
* It is easy to use; any user be it beginner or a professional can use it easily.
* It is easy to install; it requires Java Runtime Environment but everything else is included in standard downloads.
* It is fully internationalized, i.e., it has been translated to many other languages.
* It is fully documented, set of useful documents and helpline files are included.
* It works well with other tools, so that we can use other tools in conjunction with zap if we need to.
* It supports the use of well-regarded components.
These principles can be seen as the motivation behind ZAP, to summarise, it is designed to give everyone interested the chance to easily run security tests, at no cost, no matter their experience, the computer they use or the language they speak.
OWASP (Open Web Application Security Project) is a non-profit organisation that publishes freely-available articles, and aside from tools like ZAP they also provide documentation and technologies that deal with web application security. A lot of other security publications refer to the OWASP publications, for example the OWASP Top 10 which is looking at the biggest security risks for organisations and which will be featured in its own chapter in this here paper later on.
They also offer a Testing guide as well as a Development guide offering best practice information to those interested and many more interesting resources.

=== Description ===
ZAP’s focus is on testing web applications, the core idea behind it is a ”Man-in-the-Middle proxy”, that is, all web traffic between the web browser and the web application is first directed through ZAP. The data and messages can be intercepted, inspected, even modified before they are forwarded to their actual destination.
There are different ways to run ZAP, it is possible to use it as a stand-alone application (Java 8+ is required) or as a daemon process.

It is also possible to run ZAP in combination with another proxy, e.g. if a company runs their web traffic through their own proxy or firewall solution first. In this case we configure our browser to connect to ZAP, and then we can configure ZAP to connect to that other proxy.

There are various Add-ons as well as an API which make it possible to be used in a variety of scenarios and also to extend ZAP further in the future.
As stated in the principles, ZAP targets all skill levels, from those new to security testing who will probably start out by using automated tests, to developers, to those that run security tests for a living and can be considered specialists, making use of a variety of features including manual tests. The flexibility and extensibility (via add-ons in the ZAP marketplace that is part of the client) that ZAP provides make it a popular choice among security testers, add to that it is available for free and for pretty much every major operating system.
Since we’re talking about security, to a lot of people it is also important to know what their security tools really do. ZAP is open source and code examination is possible if so desired, one can look at how certain functions are implemented and the developers are transparent about which data ZAP is ”sending home” (e.g. checks for new versions), and also how that background data can be controlled or even disabled (where possible).
The ZAP community is also very open to new developers, anyone can submit bug fixes or create additional features for ZAP.

==How-To==
===Installation===
[[File:Zap-installation.png|thumb|ZAP Installation]]

First, go to the [https://www.zaproxy.org/download/ Download section on the official website for ZAP] and select the installer for your operating system.

Additionally, a Java version 8 or higher must be installed. That’s pretty much it, one needs to agree to the terms of service and then ZAP is ready to go.

===Quickstart/Automated Scan===
[[File:Zap-persist session.png|thumb|ZAP Session Persistence]]
After opening ZAP you are asked if you want to persist the session. Answer "No" to quickly skip to the Quickstart.
[[File:Zap-quickstart.png|thumb|ZAP Quickstart]]
The easiest way to start using ZAP is via the Quick Start tab. Quick Start is a ZAP add-on that is included automatically when you installed ZAP.
To run a Quick Start Automated Scan:
* Start ZAP and click the Quick Start tab of the Workspace Window.
* Click the large Automated Scan button.
* In the URL to attack text box, enter the full URL of the web application you want to attack.
* Click the Attack button

===Manual Scan===
[[File:Zap-hud firefox.png|thumb|ZAP HUD Welcome Message]]
A manual scan can be done the following way:
* Start ZAP and click the Quick Start tab of the Workspace Window. (see above)
* Click the large Manual Explore button.
* In the URL to explore text box, enter the full URL of the web application you want to explore.
* Select the browser you would like to use
* Click the Launch Browser

Next you will be presented with a welcome message that includes the HUD tutorial.

===Add-Ons===
There is a so-called '''Marketplace''' for ZAP where Add-ons can be found. These make it possible to extend the functionality of ZAP even further, and typically it is possible to add or remove them without restarting the ZAP application.
Usually Add-ons are assigned one of the following states:
* Release: high-quality add-on
* Beta: reasonable quality but possibly incomplete or still requires testing • Alpha: requires further development

[[File:Zap-addons.png|thumb|Manage Add-Ons]]
You can reach the marketplace by clicking on the blue-red-green squares symbol in the UI, it stands for "Manage Add-Ons".

===User Agent Settings===
If you go to ''Tools → Options → Connection'' in the ZAP GUI you can configure the Default User Agent (as in, which browser as well as operating system) that ZAP should pretend to be when connecting to websites. You may get different responses depending on this, especially older websites did have their own configurations for Internet Explorer that were unlike those for other browsers.

=== API ===
It is possible to interact with ZAP using its powerful Application Programming Interface (API), almost every feature that the GUI offers can be accessed via API and more features are being added with future versions. It also helps not only beginners that there is an [https://www.zaproxy.org/docs/api extensive documentation] for the API, giving examples for Shell script, Python and Java commands to run features.

Requests to the API are via GET and POST endpoints, responses are available in a variety of formats such as JSON, HTML and HTML but also custom formats such as HAR. The content of the response formats is always the same but the developer can select the format that best fits their use case depending on what they are looking for. There are recommendations given such as using HTML for good readability in reports, JSON or XML if one is looking to quickly parse the returned result.

It is also possible to use ZAP to scan APIs and even automate the scanning process for these API scans, using the same file formats we that we use for ZAP’s own API (JSON, etc.). However, the main problem with scanning APIs is the exploration, figuring out what to target and using which methods since most of the time browsing or spidering will not lead to useful results for APIs.

====Why is an API key required by default?====
Since ZAP can be controlled via API, we also must protect it from malicious sites or attackers that are looking to basically remotely control our ZAP installation or make changes to it. So it was decided to make the usage of an API key mandatory to hinder these attempts.

===Attack the OWASP Top 10 using ZAP===

One of the many guides found at the ZAP website is about how to attack the top 10 security threats using ZAP. The content of the following tables is taken from the [https://www.zaproxy.org/docs/guides/zapping-the-top-10/ Zapping the Top 10 Guide].

{| class="wikitable"
|+ Common Components
|-
|-
| ''Manual'' || Man-in-the-middle proxy
|-
| ''Manual'' || Manual request / resend
|-
| ''Manual'' || Scripts
|-
| ''Manual'' || Search
|}

{| class="wikitable"
|+ A1 Injection
|-
|-
| ''Automated'' || Active Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Advanced SQLInjection Scanner* (Based on SQLMap)
|-
| ''Manual'' || Fuzzer, combined with the FuzzDb* and SVN Digger* files
|}

{| class="wikitable"
|+ A2 Broken Authentication
|-
|-
| ''Manual'' || HTTP Sessions
|-
| ''Manual'' || Spider
|-
| ''Manual'' || Forced Browse
|-
| ''Manual'' || Token Generator*
|-
| ''Automatic'' || Access Control Testing*
|}

{| class="wikitable"
|+ A3 Sensitive Data Exposure
|-
|-
| ''Automated'' || Active Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Passive Scan Rules (Release, Beta*, and Alpha*)
|}

{| class="wikitable"
|+ A4 XML External Entities (XXE)
|-
| ''Automatic'' || Active Scan Rules (Release, Beta*, and Alpha*)
|}

{| class="wikitable"
|+ A5 Broken Access Control
|-
| ''Automated'' || Active Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Passive Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Access Control Testing*
|-
| ''Manual'' || HttpsInfo*
|-
| ''Manual'' || Port Scanner*
|-
| ''Manual'' || Wappalyzer - Technology detection*
|}

{| class="wikitable"
|+ A6 Security Misconfiguration
|-
|-
| ''Manual'' || Spider
|-
| ''Manual'' || Ajax Spider
|-
| ''Manual'' || Session comparison
|-
| ''Manual'' || Access Control Testing*
|-
| ''Manual'' || HttpsInfo*
|}

{| class="wikitable"
|+ A7 Cross-Site Scripting (XSS)
|-
| ''Automated'' || Active Scan Rules (Release)
|-
| ''Manual'' || Fuzzer, combined with the FuzzDb* files
|-
| ''Manual'' || Plug-n-Hack
|}

{| class="wikitable"
|+ A8 Insecure Deserialization
|-
| ''Automated'' || There are two outstanding issues that are relevant to this Top 10 entry: Insecure deserialization active scanner & Java Serialization Handling
|}

{| class="wikitable"
|+ A9 Using Components with Known Vulnerabilities
|-
| ''Automated'' || Passive Scan Rules (Alpha*) and Retire
|-
| ''Manual'' || Wappalyzer - Technology detection
|}

{| class="wikitable"
|+ A10 Insufficient Logging & Monitoring
|-
| ''Automated / Manual'' || The Spider(s), Active Scanner, Fuzzer, and Access Control addon can all be used to generate traffic and ”attacks” which are
potential sources/causes for logging and alerting.
|}

Note: Add-ons marked with a * are not part of the default installation of ZAP, they can be installed using the ZAP Marketplace

==Modes==
ZAP has different modes to to choose from:
* Safe: only allows operations that are considered not dangerous
* Protected: the officially recommended mode, it does allow dangerous operations but only on URLs that were put in the Scope of our target
* Standard: everything goes
* ATTACK: this mode sets ZAP to scan new nodes within the Scope to be actively scanned as soon as they are discovered

===Passive versus Active Scanning===
Passive scanning is considered safe and legal, too, it is used to find vulnerabilities and none of the requests or responses change. It is also run in a background thread so it does not negatively affect the performance when exploring an application.

With Active Scanning we might actually attack our target so this should be done with caution and of course permission only, we could end up altering data at the target site with an active scan.

Limitations of a standard passive scan are that pages that require a login can not be accessed by ZAP since the authentication will not be handled by ZAP. It is, however, possible to configure the functionality to authenticate. Another limitation is that the sequence in which a passive scan explores the target is pretty much uncontrollable. But ZAP offers a solution for almost every limitation, and that means there are many extra features in ZAP for exploring and attacking other than the passive scan. For exploring a site we already mentioned spidering as a viable option but we need to keep in mind that they also are rather limited when it comes to filling out forms, they may enter default data or random strings instead of the required information. So it is suggested that spidering is used in combination with manual exploration, so that an actual user can, for example, fill out form data if an error message is returned.

Another recommendation for exploration is to take a look at the web application with a browser proxying through ZAP, the benefit of this method is that all requests and responses undergo a passive scan by ZAP and a site tree is built. Additionally, ZAP will record potential vulnerabilities that it finds for future reference.

OWASP ZAP

2020-12-18T13:27:47Z

MMuszik: /* Attack the OWASP Top 10 using ZAP */

== Introduction ==
=== About ===
ZAP is short for Zed Attack Proxy. Before we delve into details as to what this means, what it is about, why it was created and what it can be used for, let us start by having a look at the ''principles of ZAP'' first for a better understanding.

The principles are:
* It is free, open source which means anyone can access and use it.
* It is also cross platform that is it works on Linux, Windows and Macs.
* It is easy to use; any user be it beginner or a professional can use it easily.
* It is easy to install; it requires Java Runtime Environment but everything else is included in standard downloads.
* It is fully internationalized, i.e., it has been translated to many other languages.
* It is fully documented, set of useful documents and helpline files are included.
* It works well with other tools, so that we can use other tools in conjunction with zap if we need to.
* It supports the use of well-regarded components.
These principles can be seen as the motivation behind ZAP, to summarise, it is designed to give everyone interested the chance to easily run security tests, at no cost, no matter their experience, the computer they use or the language they speak.
OWASP (Open Web Application Security Project) is a non-profit organisation that publishes freely-available articles, and aside from tools like ZAP they also provide documentation and technologies that deal with web application security. A lot of other security publications refer to the OWASP publications, for example the OWASP Top 10 which is looking at the biggest security risks for organisations and which will be featured in its own chapter in this here paper later on.
They also offer a Testing guide as well as a Development guide offering best practice information to those interested and many more interesting resources.

=== Description ===
ZAP’s focus is on testing web applications, the core idea behind it is a ”Man-in-the-Middle proxy”, that is, all web traffic between the web browser and the web application is first directed through ZAP. The data and messages can be intercepted, inspected, even modified before they are forwarded to their actual destination.
There are different ways to run ZAP, it is possible to use it as a stand-alone application (Java 8+ is required) or as a daemon process.

It is also possible to run ZAP in combination with another proxy, e.g. if a company runs their web traffic through their own proxy or firewall solution first. In this case we configure our browser to connect to ZAP, and then we can configure ZAP to connect to that other proxy.

There are various Add-ons as well as an API which make it possible to be used in a variety of scenarios and also to extend ZAP further in the future.
As stated in the principles, ZAP targets all skill levels, from those new to security testing who will probably start out by using automated tests, to developers, to those that run security tests for a living and can be considered specialists, making use of a variety of features including manual tests. The flexibility and extensibility (via add-ons in the ZAP marketplace that is part of the client) that ZAP provides make it a popular choice among security testers, add to that it is available for free and for pretty much every major operating system.
Since we’re talking about security, to a lot of people it is also important to know what their security tools really do. ZAP is open source and code examination is possible if so desired, one can look at how certain functions are implemented and the developers are transparent about which data ZAP is ”sending home” (e.g. checks for new versions), and also how that background data can be controlled or even disabled (where possible).
The ZAP community is also very open to new developers, anyone can submit bug fixes or create additional features for ZAP.

==How-To==
===Installation===
[[File:Zap-installation.png|thumb|ZAP Installation]]

First, go to the [https://www.zaproxy.org/download/ Download section on the official website for ZAP] and select the installer for your operating system.

Additionally, a Java version 8 or higher must be installed. That’s pretty much it, one needs to agree to the terms of service and then ZAP is ready to go.

===Quickstart/Automated Scan===
[[File:Zap-persist session.png|thumb|ZAP Session Persistence]]
After opening ZAP you are asked if you want to persist the session. Answer "No" to quickly skip to the Quickstart.
[[File:Zap-quickstart.png|thumb|ZAP Quickstart]]
The easiest way to start using ZAP is via the Quick Start tab. Quick Start is a ZAP add-on that is included automatically when you installed ZAP.
To run a Quick Start Automated Scan:
* Start ZAP and click the Quick Start tab of the Workspace Window.
* Click the large Automated Scan button.
* In the URL to attack text box, enter the full URL of the web application you want to attack.
* Click the Attack button

===Manual Scan===
[[File:Zap-hud firefox.png|thumb|ZAP HUD Welcome Message]]
A manual scan can be done the following way:
* Start ZAP and click the Quick Start tab of the Workspace Window. (see above)
* Click the large Manual Explore button.
* In the URL to explore text box, enter the full URL of the web application you want to explore.
* Select the browser you would like to use
* Click the Launch Browser

Next you will be presented with a welcome message that includes the HUD tutorial.

===Add-Ons===
There is a so-called '''Marketplace''' for ZAP where Add-ons can be found. These make it possible to extend the functionality of ZAP even further, and typically it is possible to add or remove them without restarting the ZAP application.
Usually Add-ons are assigned one of the following states:
* Release: high-quality add-on
* Beta: reasonable quality but possibly incomplete or still requires testing • Alpha: requires further development

[[File:Zap-addons.png|thumb|Manage Add-Ons]]
You can reach the marketplace by clicking on the blue-red-green squares symbol in the UI, it stands for "Manage Add-Ons".

===User Agent Settings===
If you go to ''Tools → Options → Connection'' in the ZAP GUI you can configure the Default User Agent (as in, which browser as well as operating system) that ZAP should pretend to be when connecting to websites. You may get different responses depending on this, especially older websites did have their own configurations for Internet Explorer that were unlike those for other browsers.

=== API ===
It is possible to interact with ZAP using its powerful Application Programming Interface (API), almost every feature that the GUI offers can be accessed via API and more features are being added with future versions. It also helps not only beginners that there is an [https://www.zaproxy.org/docs/api extensive documentation] for the API, giving examples for Shell script, Python and Java commands to run features.

Requests to the API are via GET and POST endpoints, responses are available in a variety of formats such as JSON, HTML and HTML but also custom formats such as HAR. The content of the response formats is always the same but the developer can select the format that best fits their use case depending on what they are looking for. There are recommendations given such as using HTML for good readability in reports, JSON or XML if one is looking to quickly parse the returned result.

It is also possible to use ZAP to scan APIs and even automate the scanning process for these API scans, using the same file formats we that we use for ZAP’s own API (JSON, etc.). However, the main problem with scanning APIs is the exploration, figuring out what to target and using which methods since most of the time browsing or spidering will not lead to useful results for APIs.

====Why is an API key required by default?====
Since ZAP can be controlled via API, we also must protect it from malicious sites or attackers that are looking to basically remotely control our ZAP installation or make changes to it. So it was decided to make the usage of an API key mandatory to hinder these attempts.

===Attack the OWASP Top 10 using ZAP===

One of the many guides found at the ZAP website is about how to attack the top 10 security threats using ZAP. The content of the following tables is taken from the [https://www.zaproxy.org/docs/guides/zapping-the-top-10/ Zapping the Top 10 Guide].

{| class="wikitable"
|+ Common Components
|-
|-
| ''Manual'' || Man-in-the-middle proxy
|-
| ''Manual'' || Manual request / resend
|-
| ''Manual'' || Scripts
|-
| ''Manual'' || Search
|}

{| class="wikitable"
|+ A1 Injection
|-
|-
| ''Automated'' || Active Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Advanced SQLInjection Scanner* (Based on SQLMap)
|-
| ''Manual'' || Fuzzer, combined with the FuzzDb* and SVN Digger* files
|}

{| class="wikitable"
|+ A2 Broken Authentication
|-
|-
| ''Manual'' || HTTP Sessions
|-
| ''Manual'' || Spider
|-
| ''Manual'' || Forced Browse
|-
| ''Manual'' || Token Generator*
|-
| ''Automatic'' || Access Control Testing*
|}

{| class="wikitable"
|+ A3 Sensitive Data Exposure
|-
|-
| ''Automated'' || Active Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Passive Scan Rules (Release, Beta*, and Alpha*)
|}

{| class="wikitable"
|+ A4 XML External Entities (XXE)
|-
| ''Automatic'' || Active Scan Rules (Release, Beta*, and Alpha*)
|}

{| class="wikitable"
|+ A5 Broken Access Control
|-
| ''Automated'' || Active Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Passive Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Access Control Testing*
|-
| ''Manual'' || HttpsInfo*
|-
| ''Manual'' || Port Scanner*
|-
| ''Manual'' || Wappalyzer - Technology detection*
|}

{| class="wikitable"
|+ A6 Security Misconfiguration
|-
|-
| ''Manual'' || Spider
|-
| ''Manual'' || Ajax Spider
|-
| ''Manual'' || Session comparison
|-
| ''Manual'' || Access Control Testing*
|-
| ''Manual'' || HttpsInfo*
|}

{| class="wikitable"
|+ A7 Cross-Site Scripting (XSS)
|-
| ''Automated'' || Active Scan Rules (Release)
|-
| ''Manual'' || Fuzzer, combined with the FuzzDb* files
|-
| ''Manual'' || Plug-n-Hack
|}

{| class="wikitable"
|+ A8 Insecure Deserialization
|-
| ''Automated'' || There are two outstanding issues that are relevant to this Top 10 entry: Insecure deserialization active scanner & Java Serialization Handling
|}

{| class="wikitable"
|+ A9 Using Components with Known Vulnerabilities
|-
| ''Automated'' || Passive Scan Rules (Alpha*) and Retire
|-
| ''Manual'' || Wappalyzer - Technology detection
|}

==Modes==
ZAP has different modes to to choose from:
* Safe: only allows operations that are considered not dangerous
* Protected: the officially recommended mode, it does allow dangerous operations but only on URLs that were put in the Scope of our target
* Standard: everything goes
* ATTACK: this mode sets ZAP to scan new nodes within the Scope to be actively scanned as soon as they are discovered

===Passive versus Active Scanning===
Passive scanning is considered safe and legal, too, it is used to find vulnerabilities and none of the requests or responses change. It is also run in a background thread so it does not negatively affect the performance when exploring an application.

With Active Scanning we might actually attack our target so this should be done with caution and of course permission only, we could end up altering data at the target site with an active scan.

Limitations of a standard passive scan are that pages that require a login can not be accessed by ZAP since the authentication will not be handled by ZAP. It is, however, possible to configure the functionality to authenticate. Another limitation is that the sequence in which a passive scan explores the target is pretty much uncontrollable. But ZAP offers a solution for almost every limitation, and that means there are many extra features in ZAP for exploring and attacking other than the passive scan. For exploring a site we already mentioned spidering as a viable option but we need to keep in mind that they also are rather limited when it comes to filling out forms, they may enter default data or random strings instead of the required information. So it is suggested that spidering is used in combination with manual exploration, so that an actual user can, for example, fill out form data if an error message is returned.

Another recommendation for exploration is to take a look at the web application with a browser proxying through ZAP, the benefit of this method is that all requests and responses undergo a passive scan by ZAP and a site tree is built. Additionally, ZAP will record potential vulnerabilities that it finds for future reference.

OWASP ZAP

2020-12-18T13:26:50Z

MMuszik: /* Attack the OWASP Top 10 using ZAP */

== Introduction ==
=== About ===
ZAP is short for Zed Attack Proxy. Before we delve into details as to what this means, what it is about, why it was created and what it can be used for, let us start by having a look at the ''principles of ZAP'' first for a better understanding.

The principles are:
* It is free, open source which means anyone can access and use it.
* It is also cross platform that is it works on Linux, Windows and Macs.
* It is easy to use; any user be it beginner or a professional can use it easily.
* It is easy to install; it requires Java Runtime Environment but everything else is included in standard downloads.
* It is fully internationalized, i.e., it has been translated to many other languages.
* It is fully documented, set of useful documents and helpline files are included.
* It works well with other tools, so that we can use other tools in conjunction with zap if we need to.
* It supports the use of well-regarded components.
These principles can be seen as the motivation behind ZAP, to summarise, it is designed to give everyone interested the chance to easily run security tests, at no cost, no matter their experience, the computer they use or the language they speak.
OWASP (Open Web Application Security Project) is a non-profit organisation that publishes freely-available articles, and aside from tools like ZAP they also provide documentation and technologies that deal with web application security. A lot of other security publications refer to the OWASP publications, for example the OWASP Top 10 which is looking at the biggest security risks for organisations and which will be featured in its own chapter in this here paper later on.
They also offer a Testing guide as well as a Development guide offering best practice information to those interested and many more interesting resources.

=== Description ===
ZAP’s focus is on testing web applications, the core idea behind it is a ”Man-in-the-Middle proxy”, that is, all web traffic between the web browser and the web application is first directed through ZAP. The data and messages can be intercepted, inspected, even modified before they are forwarded to their actual destination.
There are different ways to run ZAP, it is possible to use it as a stand-alone application (Java 8+ is required) or as a daemon process.

It is also possible to run ZAP in combination with another proxy, e.g. if a company runs their web traffic through their own proxy or firewall solution first. In this case we configure our browser to connect to ZAP, and then we can configure ZAP to connect to that other proxy.

There are various Add-ons as well as an API which make it possible to be used in a variety of scenarios and also to extend ZAP further in the future.
As stated in the principles, ZAP targets all skill levels, from those new to security testing who will probably start out by using automated tests, to developers, to those that run security tests for a living and can be considered specialists, making use of a variety of features including manual tests. The flexibility and extensibility (via add-ons in the ZAP marketplace that is part of the client) that ZAP provides make it a popular choice among security testers, add to that it is available for free and for pretty much every major operating system.
Since we’re talking about security, to a lot of people it is also important to know what their security tools really do. ZAP is open source and code examination is possible if so desired, one can look at how certain functions are implemented and the developers are transparent about which data ZAP is ”sending home” (e.g. checks for new versions), and also how that background data can be controlled or even disabled (where possible).
The ZAP community is also very open to new developers, anyone can submit bug fixes or create additional features for ZAP.

==How-To==
===Installation===
[[File:Zap-installation.png|thumb|ZAP Installation]]

First, go to the [https://www.zaproxy.org/download/ Download section on the official website for ZAP] and select the installer for your operating system.

Additionally, a Java version 8 or higher must be installed. That’s pretty much it, one needs to agree to the terms of service and then ZAP is ready to go.

===Quickstart/Automated Scan===
[[File:Zap-persist session.png|thumb|ZAP Session Persistence]]
After opening ZAP you are asked if you want to persist the session. Answer "No" to quickly skip to the Quickstart.
[[File:Zap-quickstart.png|thumb|ZAP Quickstart]]
The easiest way to start using ZAP is via the Quick Start tab. Quick Start is a ZAP add-on that is included automatically when you installed ZAP.
To run a Quick Start Automated Scan:
* Start ZAP and click the Quick Start tab of the Workspace Window.
* Click the large Automated Scan button.
* In the URL to attack text box, enter the full URL of the web application you want to attack.
* Click the Attack button

===Manual Scan===
[[File:Zap-hud firefox.png|thumb|ZAP HUD Welcome Message]]
A manual scan can be done the following way:
* Start ZAP and click the Quick Start tab of the Workspace Window. (see above)
* Click the large Manual Explore button.
* In the URL to explore text box, enter the full URL of the web application you want to explore.
* Select the browser you would like to use
* Click the Launch Browser

Next you will be presented with a welcome message that includes the HUD tutorial.

===Add-Ons===
There is a so-called '''Marketplace''' for ZAP where Add-ons can be found. These make it possible to extend the functionality of ZAP even further, and typically it is possible to add or remove them without restarting the ZAP application.
Usually Add-ons are assigned one of the following states:
* Release: high-quality add-on
* Beta: reasonable quality but possibly incomplete or still requires testing • Alpha: requires further development

[[File:Zap-addons.png|thumb|Manage Add-Ons]]
You can reach the marketplace by clicking on the blue-red-green squares symbol in the UI, it stands for "Manage Add-Ons".

===User Agent Settings===
If you go to ''Tools → Options → Connection'' in the ZAP GUI you can configure the Default User Agent (as in, which browser as well as operating system) that ZAP should pretend to be when connecting to websites. You may get different responses depending on this, especially older websites did have their own configurations for Internet Explorer that were unlike those for other browsers.

=== API ===
It is possible to interact with ZAP using its powerful Application Programming Interface (API), almost every feature that the GUI offers can be accessed via API and more features are being added with future versions. It also helps not only beginners that there is an [https://www.zaproxy.org/docs/api extensive documentation] for the API, giving examples for Shell script, Python and Java commands to run features.

Requests to the API are via GET and POST endpoints, responses are available in a variety of formats such as JSON, HTML and HTML but also custom formats such as HAR. The content of the response formats is always the same but the developer can select the format that best fits their use case depending on what they are looking for. There are recommendations given such as using HTML for good readability in reports, JSON or XML if one is looking to quickly parse the returned result.

It is also possible to use ZAP to scan APIs and even automate the scanning process for these API scans, using the same file formats we that we use for ZAP’s own API (JSON, etc.). However, the main problem with scanning APIs is the exploration, figuring out what to target and using which methods since most of the time browsing or spidering will not lead to useful results for APIs.

====Why is an API key required by default?====
Since ZAP can be controlled via API, we also must protect it from malicious sites or attackers that are looking to basically remotely control our ZAP installation or make changes to it. So it was decided to make the usage of an API key mandatory to hinder these attempts.

===Attack the OWASP Top 10 using ZAP===

One of the many guides found at the ZAP website is about how to attack the top 10 security threats using ZAP. The content of the following tables is taken from the [https://www.zaproxy.org/docs/guides/zapping-the-top-10/ Zapping the Top 10 Guide].

{| class="wikitable"
|+ Common Components
|-
|-
| ''Manual'' || Man-in-the-middle proxy
|-
| ''Manual'' || Manual request / resend
|-
| ''Manual'' || Scripts
|-
| ''Manual'' || Search
|}

{| class="wikitable"
|+ A1 Injection
|-
|-
| ''Automated'' || Active Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Advanced SQLInjection Scanner* (Based on SQLMap)
|-
| ''Manual'' || Fuzzer, combined with the FuzzDb* and SVN Digger* files
|}

{| class="wikitable"
|+ A2 Broken Authentication
|-
|-
| ''Manual'' || HTTP Sessions
|-
| ''Manual'' || Spider
|-
| ''Manual'' || Forced Browse
|-
| ''Manual'' || Token Generator*
|-
| ''Automatic'' || Access Control Testing*
|}

{| class="wikitable"
|+ A3 Sensitive Data Exposure
|-
|-
| ''Automated'' || Active Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Passive Scan Rules (Release, Beta*, and Alpha*)
|}

{| class="wikitable"
|+ A4 XML External Entities (XXE)
|-
| ''Automatic'' || Active Scan Rules (Release, Beta*, and Alpha*)
|}

{| class="wikitable"
|+ A5 Broken Access Control
|-
| ''Automated'' || Active Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Passive Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Access Control Testing*
|-
| ''Manual'' || HttpsInfo*
|-
| ''Manual'' || Port Scanner*
|-
| ''Manual'' || Wappalyzer - Technology detection*
|}

{| class="wikitable"
|+ A6 Security Misconfiguration
|-
|-
| ''Manual'' || Spider
|-
| ''Manual'' || Ajax Spider
|-
| ''Manual'' || Session comparison
|-
| ''Manual'' || Access Control Testing*
|-
| ''Manual'' || HttpsInfo*
|}

{| class="wikitable"
|+ A7 Cross-Site Scripting (XSS)
|-
| ''Automated'' || Active Scan Rules (Release)
|-
| ''Manual'' || Fuzzer, combined with the FuzzDb* files
|-
| ''Manual'' || Plug-n-Hack
|}

{| class="wikitable"
|+ A8 Insecure Deserialization
|-
| ''Automated'' || There are two outstanding issues that are relevant to this Top 10 entry: Insecure deserialization active scanner & Java Serialization Handling
|}

==Modes==
ZAP has different modes to to choose from:
* Safe: only allows operations that are considered not dangerous
* Protected: the officially recommended mode, it does allow dangerous operations but only on URLs that were put in the Scope of our target
* Standard: everything goes
* ATTACK: this mode sets ZAP to scan new nodes within the Scope to be actively scanned as soon as they are discovered

===Passive versus Active Scanning===
Passive scanning is considered safe and legal, too, it is used to find vulnerabilities and none of the requests or responses change. It is also run in a background thread so it does not negatively affect the performance when exploring an application.

With Active Scanning we might actually attack our target so this should be done with caution and of course permission only, we could end up altering data at the target site with an active scan.

Limitations of a standard passive scan are that pages that require a login can not be accessed by ZAP since the authentication will not be handled by ZAP. It is, however, possible to configure the functionality to authenticate. Another limitation is that the sequence in which a passive scan explores the target is pretty much uncontrollable. But ZAP offers a solution for almost every limitation, and that means there are many extra features in ZAP for exploring and attacking other than the passive scan. For exploring a site we already mentioned spidering as a viable option but we need to keep in mind that they also are rather limited when it comes to filling out forms, they may enter default data or random strings instead of the required information. So it is suggested that spidering is used in combination with manual exploration, so that an actual user can, for example, fill out form data if an error message is returned.

Another recommendation for exploration is to take a look at the web application with a browser proxying through ZAP, the benefit of this method is that all requests and responses undergo a passive scan by ZAP and a site tree is built. Additionally, ZAP will record potential vulnerabilities that it finds for future reference.

OWASP ZAP

2020-12-18T13:21:56Z

MMuszik: /* Attack the OWASP Top 10 using ZAP */

== Introduction ==
=== About ===
ZAP is short for Zed Attack Proxy. Before we delve into details as to what this means, what it is about, why it was created and what it can be used for, let us start by having a look at the ''principles of ZAP'' first for a better understanding.

The principles are:
* It is free, open source which means anyone can access and use it.
* It is also cross platform that is it works on Linux, Windows and Macs.
* It is easy to use; any user be it beginner or a professional can use it easily.
* It is easy to install; it requires Java Runtime Environment but everything else is included in standard downloads.
* It is fully internationalized, i.e., it has been translated to many other languages.
* It is fully documented, set of useful documents and helpline files are included.
* It works well with other tools, so that we can use other tools in conjunction with zap if we need to.
* It supports the use of well-regarded components.
These principles can be seen as the motivation behind ZAP, to summarise, it is designed to give everyone interested the chance to easily run security tests, at no cost, no matter their experience, the computer they use or the language they speak.
OWASP (Open Web Application Security Project) is a non-profit organisation that publishes freely-available articles, and aside from tools like ZAP they also provide documentation and technologies that deal with web application security. A lot of other security publications refer to the OWASP publications, for example the OWASP Top 10 which is looking at the biggest security risks for organisations and which will be featured in its own chapter in this here paper later on.
They also offer a Testing guide as well as a Development guide offering best practice information to those interested and many more interesting resources.

=== Description ===
ZAP’s focus is on testing web applications, the core idea behind it is a ”Man-in-the-Middle proxy”, that is, all web traffic between the web browser and the web application is first directed through ZAP. The data and messages can be intercepted, inspected, even modified before they are forwarded to their actual destination.
There are different ways to run ZAP, it is possible to use it as a stand-alone application (Java 8+ is required) or as a daemon process.

It is also possible to run ZAP in combination with another proxy, e.g. if a company runs their web traffic through their own proxy or firewall solution first. In this case we configure our browser to connect to ZAP, and then we can configure ZAP to connect to that other proxy.

There are various Add-ons as well as an API which make it possible to be used in a variety of scenarios and also to extend ZAP further in the future.
As stated in the principles, ZAP targets all skill levels, from those new to security testing who will probably start out by using automated tests, to developers, to those that run security tests for a living and can be considered specialists, making use of a variety of features including manual tests. The flexibility and extensibility (via add-ons in the ZAP marketplace that is part of the client) that ZAP provides make it a popular choice among security testers, add to that it is available for free and for pretty much every major operating system.
Since we’re talking about security, to a lot of people it is also important to know what their security tools really do. ZAP is open source and code examination is possible if so desired, one can look at how certain functions are implemented and the developers are transparent about which data ZAP is ”sending home” (e.g. checks for new versions), and also how that background data can be controlled or even disabled (where possible).
The ZAP community is also very open to new developers, anyone can submit bug fixes or create additional features for ZAP.

==How-To==
===Installation===
[[File:Zap-installation.png|thumb|ZAP Installation]]

First, go to the [https://www.zaproxy.org/download/ Download section on the official website for ZAP] and select the installer for your operating system.

Additionally, a Java version 8 or higher must be installed. That’s pretty much it, one needs to agree to the terms of service and then ZAP is ready to go.

===Quickstart/Automated Scan===
[[File:Zap-persist session.png|thumb|ZAP Session Persistence]]
After opening ZAP you are asked if you want to persist the session. Answer "No" to quickly skip to the Quickstart.
[[File:Zap-quickstart.png|thumb|ZAP Quickstart]]
The easiest way to start using ZAP is via the Quick Start tab. Quick Start is a ZAP add-on that is included automatically when you installed ZAP.
To run a Quick Start Automated Scan:
* Start ZAP and click the Quick Start tab of the Workspace Window.
* Click the large Automated Scan button.
* In the URL to attack text box, enter the full URL of the web application you want to attack.
* Click the Attack button

===Manual Scan===
[[File:Zap-hud firefox.png|thumb|ZAP HUD Welcome Message]]
A manual scan can be done the following way:
* Start ZAP and click the Quick Start tab of the Workspace Window. (see above)
* Click the large Manual Explore button.
* In the URL to explore text box, enter the full URL of the web application you want to explore.
* Select the browser you would like to use
* Click the Launch Browser

Next you will be presented with a welcome message that includes the HUD tutorial.

===Add-Ons===
There is a so-called '''Marketplace''' for ZAP where Add-ons can be found. These make it possible to extend the functionality of ZAP even further, and typically it is possible to add or remove them without restarting the ZAP application.
Usually Add-ons are assigned one of the following states:
* Release: high-quality add-on
* Beta: reasonable quality but possibly incomplete or still requires testing • Alpha: requires further development

[[File:Zap-addons.png|thumb|Manage Add-Ons]]
You can reach the marketplace by clicking on the blue-red-green squares symbol in the UI, it stands for "Manage Add-Ons".

===User Agent Settings===
If you go to ''Tools → Options → Connection'' in the ZAP GUI you can configure the Default User Agent (as in, which browser as well as operating system) that ZAP should pretend to be when connecting to websites. You may get different responses depending on this, especially older websites did have their own configurations for Internet Explorer that were unlike those for other browsers.

=== API ===
It is possible to interact with ZAP using its powerful Application Programming Interface (API), almost every feature that the GUI offers can be accessed via API and more features are being added with future versions. It also helps not only beginners that there is an [https://www.zaproxy.org/docs/api extensive documentation] for the API, giving examples for Shell script, Python and Java commands to run features.

Requests to the API are via GET and POST endpoints, responses are available in a variety of formats such as JSON, HTML and HTML but also custom formats such as HAR. The content of the response formats is always the same but the developer can select the format that best fits their use case depending on what they are looking for. There are recommendations given such as using HTML for good readability in reports, JSON or XML if one is looking to quickly parse the returned result.

It is also possible to use ZAP to scan APIs and even automate the scanning process for these API scans, using the same file formats we that we use for ZAP’s own API (JSON, etc.). However, the main problem with scanning APIs is the exploration, figuring out what to target and using which methods since most of the time browsing or spidering will not lead to useful results for APIs.

====Why is an API key required by default?====
Since ZAP can be controlled via API, we also must protect it from malicious sites or attackers that are looking to basically remotely control our ZAP installation or make changes to it. So it was decided to make the usage of an API key mandatory to hinder these attempts.

===Attack the OWASP Top 10 using ZAP===

One of the many guides found at the ZAP website is about how to attack the top 10 security threats using ZAP. The content of the following tables is taken from the [https://www.zaproxy.org/docs/guides/zapping-the-top-10/ Zapping the Top 10 Guide].

{| class="wikitable"
|+ Common Components
|-
|-
| ''Manual'' || Man-in-the-middle proxy
|-
| ''Manual'' || Manual request / resend
|-
| ''Manual'' || Scripts
|-
| ''Manual'' || Search
|}

{| class="wikitable"
|+ A1 Injection
|-
|-
| ''Automated'' || Active Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Advanced SQLInjection Scanner* (Based on SQLMap)
|-
| ''Manual'' || Fuzzer, combined with the FuzzDb* and SVN Digger* files
|}

{| class="wikitable"
|+ A2 Broken Authentication
|-
|-
| ''Manual'' || HTTP Sessions
|-
| ''Manual'' || Spider
|-
| ''Manual'' || Forced Browse
|-
| ''Manual'' || Token Generator*
|-
| ''Automatic'' || Access Control Testing*
|}

{| class="wikitable"
|+ A3 Sensitive Data Exposure
|-
|-
| ''Automated'' || Active Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Passive Scan Rules (Release, Beta*, and Alpha*)
|}

{| class="wikitable"
|+ A4 XML External Entities (XXE)
|-
| ''Automatic'' || Active Scan Rules (Release, Beta*, and Alpha*)
|}

{| class="wikitable"
|+ A5 Broken Access Control
|-
| ''Automated'' || Active Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Passive Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Access Control Testing*
|-
| ''Manual'' || HttpsInfo*
|-
| ''Manual'' || Port Scanner*
|-
| ''Manual'' || Wappalyzer - Technology detection*
|}

==Modes==
ZAP has different modes to to choose from:
* Safe: only allows operations that are considered not dangerous
* Protected: the officially recommended mode, it does allow dangerous operations but only on URLs that were put in the Scope of our target
* Standard: everything goes
* ATTACK: this mode sets ZAP to scan new nodes within the Scope to be actively scanned as soon as they are discovered

===Passive versus Active Scanning===
Passive scanning is considered safe and legal, too, it is used to find vulnerabilities and none of the requests or responses change. It is also run in a background thread so it does not negatively affect the performance when exploring an application.

With Active Scanning we might actually attack our target so this should be done with caution and of course permission only, we could end up altering data at the target site with an active scan.

Limitations of a standard passive scan are that pages that require a login can not be accessed by ZAP since the authentication will not be handled by ZAP. It is, however, possible to configure the functionality to authenticate. Another limitation is that the sequence in which a passive scan explores the target is pretty much uncontrollable. But ZAP offers a solution for almost every limitation, and that means there are many extra features in ZAP for exploring and attacking other than the passive scan. For exploring a site we already mentioned spidering as a viable option but we need to keep in mind that they also are rather limited when it comes to filling out forms, they may enter default data or random strings instead of the required information. So it is suggested that spidering is used in combination with manual exploration, so that an actual user can, for example, fill out form data if an error message is returned.

Another recommendation for exploration is to take a look at the web application with a browser proxying through ZAP, the benefit of this method is that all requests and responses undergo a passive scan by ZAP and a site tree is built. Additionally, ZAP will record potential vulnerabilities that it finds for future reference.

OWASP ZAP

2020-12-18T13:20:08Z

MMuszik: /* Attack the OWASP Top 10 using ZAP */

== Introduction ==
=== About ===
ZAP is short for Zed Attack Proxy. Before we delve into details as to what this means, what it is about, why it was created and what it can be used for, let us start by having a look at the ''principles of ZAP'' first for a better understanding.

The principles are:
* It is free, open source which means anyone can access and use it.
* It is also cross platform that is it works on Linux, Windows and Macs.
* It is easy to use; any user be it beginner or a professional can use it easily.
* It is easy to install; it requires Java Runtime Environment but everything else is included in standard downloads.
* It is fully internationalized, i.e., it has been translated to many other languages.
* It is fully documented, set of useful documents and helpline files are included.
* It works well with other tools, so that we can use other tools in conjunction with zap if we need to.
* It supports the use of well-regarded components.
These principles can be seen as the motivation behind ZAP, to summarise, it is designed to give everyone interested the chance to easily run security tests, at no cost, no matter their experience, the computer they use or the language they speak.
OWASP (Open Web Application Security Project) is a non-profit organisation that publishes freely-available articles, and aside from tools like ZAP they also provide documentation and technologies that deal with web application security. A lot of other security publications refer to the OWASP publications, for example the OWASP Top 10 which is looking at the biggest security risks for organisations and which will be featured in its own chapter in this here paper later on.
They also offer a Testing guide as well as a Development guide offering best practice information to those interested and many more interesting resources.

=== Description ===
ZAP’s focus is on testing web applications, the core idea behind it is a ”Man-in-the-Middle proxy”, that is, all web traffic between the web browser and the web application is first directed through ZAP. The data and messages can be intercepted, inspected, even modified before they are forwarded to their actual destination.
There are different ways to run ZAP, it is possible to use it as a stand-alone application (Java 8+ is required) or as a daemon process.

It is also possible to run ZAP in combination with another proxy, e.g. if a company runs their web traffic through their own proxy or firewall solution first. In this case we configure our browser to connect to ZAP, and then we can configure ZAP to connect to that other proxy.

There are various Add-ons as well as an API which make it possible to be used in a variety of scenarios and also to extend ZAP further in the future.
As stated in the principles, ZAP targets all skill levels, from those new to security testing who will probably start out by using automated tests, to developers, to those that run security tests for a living and can be considered specialists, making use of a variety of features including manual tests. The flexibility and extensibility (via add-ons in the ZAP marketplace that is part of the client) that ZAP provides make it a popular choice among security testers, add to that it is available for free and for pretty much every major operating system.
Since we’re talking about security, to a lot of people it is also important to know what their security tools really do. ZAP is open source and code examination is possible if so desired, one can look at how certain functions are implemented and the developers are transparent about which data ZAP is ”sending home” (e.g. checks for new versions), and also how that background data can be controlled or even disabled (where possible).
The ZAP community is also very open to new developers, anyone can submit bug fixes or create additional features for ZAP.

==How-To==
===Installation===
[[File:Zap-installation.png|thumb|ZAP Installation]]

First, go to the [https://www.zaproxy.org/download/ Download section on the official website for ZAP] and select the installer for your operating system.

Additionally, a Java version 8 or higher must be installed. That’s pretty much it, one needs to agree to the terms of service and then ZAP is ready to go.

===Quickstart/Automated Scan===
[[File:Zap-persist session.png|thumb|ZAP Session Persistence]]
After opening ZAP you are asked if you want to persist the session. Answer "No" to quickly skip to the Quickstart.
[[File:Zap-quickstart.png|thumb|ZAP Quickstart]]
The easiest way to start using ZAP is via the Quick Start tab. Quick Start is a ZAP add-on that is included automatically when you installed ZAP.
To run a Quick Start Automated Scan:
* Start ZAP and click the Quick Start tab of the Workspace Window.
* Click the large Automated Scan button.
* In the URL to attack text box, enter the full URL of the web application you want to attack.
* Click the Attack button

===Manual Scan===
[[File:Zap-hud firefox.png|thumb|ZAP HUD Welcome Message]]
A manual scan can be done the following way:
* Start ZAP and click the Quick Start tab of the Workspace Window. (see above)
* Click the large Manual Explore button.
* In the URL to explore text box, enter the full URL of the web application you want to explore.
* Select the browser you would like to use
* Click the Launch Browser

Next you will be presented with a welcome message that includes the HUD tutorial.

===Add-Ons===
There is a so-called '''Marketplace''' for ZAP where Add-ons can be found. These make it possible to extend the functionality of ZAP even further, and typically it is possible to add or remove them without restarting the ZAP application.
Usually Add-ons are assigned one of the following states:
* Release: high-quality add-on
* Beta: reasonable quality but possibly incomplete or still requires testing • Alpha: requires further development

[[File:Zap-addons.png|thumb|Manage Add-Ons]]
You can reach the marketplace by clicking on the blue-red-green squares symbol in the UI, it stands for "Manage Add-Ons".

===User Agent Settings===
If you go to ''Tools → Options → Connection'' in the ZAP GUI you can configure the Default User Agent (as in, which browser as well as operating system) that ZAP should pretend to be when connecting to websites. You may get different responses depending on this, especially older websites did have their own configurations for Internet Explorer that were unlike those for other browsers.

=== API ===
It is possible to interact with ZAP using its powerful Application Programming Interface (API), almost every feature that the GUI offers can be accessed via API and more features are being added with future versions. It also helps not only beginners that there is an [https://www.zaproxy.org/docs/api extensive documentation] for the API, giving examples for Shell script, Python and Java commands to run features.

Requests to the API are via GET and POST endpoints, responses are available in a variety of formats such as JSON, HTML and HTML but also custom formats such as HAR. The content of the response formats is always the same but the developer can select the format that best fits their use case depending on what they are looking for. There are recommendations given such as using HTML for good readability in reports, JSON or XML if one is looking to quickly parse the returned result.

It is also possible to use ZAP to scan APIs and even automate the scanning process for these API scans, using the same file formats we that we use for ZAP’s own API (JSON, etc.). However, the main problem with scanning APIs is the exploration, figuring out what to target and using which methods since most of the time browsing or spidering will not lead to useful results for APIs.

====Why is an API key required by default?====
Since ZAP can be controlled via API, we also must protect it from malicious sites or attackers that are looking to basically remotely control our ZAP installation or make changes to it. So it was decided to make the usage of an API key mandatory to hinder these attempts.

===Attack the OWASP Top 10 using ZAP===

One of the many guides found at the ZAP website is about how to attack the top 10 security threats using ZAP. The content of the following tables is taken from the [https://www.zaproxy.org/docs/guides/zapping-the-top-10/ Zapping the Top 10 Guide].

{| class="wikitable"
|+ Common Components
|-
|-
| ''Manual'' || Man-in-the-middle proxy
|-
| ''Manual'' || Manual request / resend
|-
| ''Manual'' || Scripts
|-
| ''Manual'' || Search
|}

{| class="wikitable"
|+ A1 Injection
|-
|-
| ''Automated'' || Active Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Advanced SQLInjection Scanner* (Based on SQLMap)
|-
| ''Manual'' || Fuzzer, combined with the FuzzDb* and SVN Digger* files
|}

{| class="wikitable"
|+ A2 Broken Authentication
|-
|-
| ''Manual'' || HTTP Sessions
|-
| ''Manual'' || Spider
|-
| ''Manual'' || Forced Browse
|-
| ''Manual'' || Token Generator*
|-
| ''Automatic'' || Access Control Testing*
|}

{| class="wikitable"
|+ A3 Sensitive Data Exposure
|-
|-
| ''Automated'' || Active Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Passive Scan Rules (Release, Beta*, and Alpha*)
|}

{| class="wikitable"
|+ A4 XML External Entities (XXE)
|-
| ''Automatic'' || Active Scan Rules (Release, Beta*, and Alpha*)
|}

==Modes==
ZAP has different modes to to choose from:
* Safe: only allows operations that are considered not dangerous
* Protected: the officially recommended mode, it does allow dangerous operations but only on URLs that were put in the Scope of our target
* Standard: everything goes
* ATTACK: this mode sets ZAP to scan new nodes within the Scope to be actively scanned as soon as they are discovered

===Passive versus Active Scanning===
Passive scanning is considered safe and legal, too, it is used to find vulnerabilities and none of the requests or responses change. It is also run in a background thread so it does not negatively affect the performance when exploring an application.

With Active Scanning we might actually attack our target so this should be done with caution and of course permission only, we could end up altering data at the target site with an active scan.

Limitations of a standard passive scan are that pages that require a login can not be accessed by ZAP since the authentication will not be handled by ZAP. It is, however, possible to configure the functionality to authenticate. Another limitation is that the sequence in which a passive scan explores the target is pretty much uncontrollable. But ZAP offers a solution for almost every limitation, and that means there are many extra features in ZAP for exploring and attacking other than the passive scan. For exploring a site we already mentioned spidering as a viable option but we need to keep in mind that they also are rather limited when it comes to filling out forms, they may enter default data or random strings instead of the required information. So it is suggested that spidering is used in combination with manual exploration, so that an actual user can, for example, fill out form data if an error message is returned.

Another recommendation for exploration is to take a look at the web application with a browser proxying through ZAP, the benefit of this method is that all requests and responses undergo a passive scan by ZAP and a site tree is built. Additionally, ZAP will record potential vulnerabilities that it finds for future reference.

OWASP ZAP

2020-12-18T13:17:14Z

MMuszik: /* Attack the OWASP Top 10 using ZAP */

== Introduction ==
=== About ===
ZAP is short for Zed Attack Proxy. Before we delve into details as to what this means, what it is about, why it was created and what it can be used for, let us start by having a look at the ''principles of ZAP'' first for a better understanding.

The principles are:
* It is free, open source which means anyone can access and use it.
* It is also cross platform that is it works on Linux, Windows and Macs.
* It is easy to use; any user be it beginner or a professional can use it easily.
* It is easy to install; it requires Java Runtime Environment but everything else is included in standard downloads.
* It is fully internationalized, i.e., it has been translated to many other languages.
* It is fully documented, set of useful documents and helpline files are included.
* It works well with other tools, so that we can use other tools in conjunction with zap if we need to.
* It supports the use of well-regarded components.
These principles can be seen as the motivation behind ZAP, to summarise, it is designed to give everyone interested the chance to easily run security tests, at no cost, no matter their experience, the computer they use or the language they speak.
OWASP (Open Web Application Security Project) is a non-profit organisation that publishes freely-available articles, and aside from tools like ZAP they also provide documentation and technologies that deal with web application security. A lot of other security publications refer to the OWASP publications, for example the OWASP Top 10 which is looking at the biggest security risks for organisations and which will be featured in its own chapter in this here paper later on.
They also offer a Testing guide as well as a Development guide offering best practice information to those interested and many more interesting resources.

=== Description ===
ZAP’s focus is on testing web applications, the core idea behind it is a ”Man-in-the-Middle proxy”, that is, all web traffic between the web browser and the web application is first directed through ZAP. The data and messages can be intercepted, inspected, even modified before they are forwarded to their actual destination.
There are different ways to run ZAP, it is possible to use it as a stand-alone application (Java 8+ is required) or as a daemon process.

It is also possible to run ZAP in combination with another proxy, e.g. if a company runs their web traffic through their own proxy or firewall solution first. In this case we configure our browser to connect to ZAP, and then we can configure ZAP to connect to that other proxy.

There are various Add-ons as well as an API which make it possible to be used in a variety of scenarios and also to extend ZAP further in the future.
As stated in the principles, ZAP targets all skill levels, from those new to security testing who will probably start out by using automated tests, to developers, to those that run security tests for a living and can be considered specialists, making use of a variety of features including manual tests. The flexibility and extensibility (via add-ons in the ZAP marketplace that is part of the client) that ZAP provides make it a popular choice among security testers, add to that it is available for free and for pretty much every major operating system.
Since we’re talking about security, to a lot of people it is also important to know what their security tools really do. ZAP is open source and code examination is possible if so desired, one can look at how certain functions are implemented and the developers are transparent about which data ZAP is ”sending home” (e.g. checks for new versions), and also how that background data can be controlled or even disabled (where possible).
The ZAP community is also very open to new developers, anyone can submit bug fixes or create additional features for ZAP.

==How-To==
===Installation===
[[File:Zap-installation.png|thumb|ZAP Installation]]

First, go to the [https://www.zaproxy.org/download/ Download section on the official website for ZAP] and select the installer for your operating system.

Additionally, a Java version 8 or higher must be installed. That’s pretty much it, one needs to agree to the terms of service and then ZAP is ready to go.

===Quickstart/Automated Scan===
[[File:Zap-persist session.png|thumb|ZAP Session Persistence]]
After opening ZAP you are asked if you want to persist the session. Answer "No" to quickly skip to the Quickstart.
[[File:Zap-quickstart.png|thumb|ZAP Quickstart]]
The easiest way to start using ZAP is via the Quick Start tab. Quick Start is a ZAP add-on that is included automatically when you installed ZAP.
To run a Quick Start Automated Scan:
* Start ZAP and click the Quick Start tab of the Workspace Window.
* Click the large Automated Scan button.
* In the URL to attack text box, enter the full URL of the web application you want to attack.
* Click the Attack button

===Manual Scan===
[[File:Zap-hud firefox.png|thumb|ZAP HUD Welcome Message]]
A manual scan can be done the following way:
* Start ZAP and click the Quick Start tab of the Workspace Window. (see above)
* Click the large Manual Explore button.
* In the URL to explore text box, enter the full URL of the web application you want to explore.
* Select the browser you would like to use
* Click the Launch Browser

Next you will be presented with a welcome message that includes the HUD tutorial.

===Add-Ons===
There is a so-called '''Marketplace''' for ZAP where Add-ons can be found. These make it possible to extend the functionality of ZAP even further, and typically it is possible to add or remove them without restarting the ZAP application.
Usually Add-ons are assigned one of the following states:
* Release: high-quality add-on
* Beta: reasonable quality but possibly incomplete or still requires testing • Alpha: requires further development

[[File:Zap-addons.png|thumb|Manage Add-Ons]]
You can reach the marketplace by clicking on the blue-red-green squares symbol in the UI, it stands for "Manage Add-Ons".

===User Agent Settings===
If you go to ''Tools → Options → Connection'' in the ZAP GUI you can configure the Default User Agent (as in, which browser as well as operating system) that ZAP should pretend to be when connecting to websites. You may get different responses depending on this, especially older websites did have their own configurations for Internet Explorer that were unlike those for other browsers.

=== API ===
It is possible to interact with ZAP using its powerful Application Programming Interface (API), almost every feature that the GUI offers can be accessed via API and more features are being added with future versions. It also helps not only beginners that there is an [https://www.zaproxy.org/docs/api extensive documentation] for the API, giving examples for Shell script, Python and Java commands to run features.

Requests to the API are via GET and POST endpoints, responses are available in a variety of formats such as JSON, HTML and HTML but also custom formats such as HAR. The content of the response formats is always the same but the developer can select the format that best fits their use case depending on what they are looking for. There are recommendations given such as using HTML for good readability in reports, JSON or XML if one is looking to quickly parse the returned result.

It is also possible to use ZAP to scan APIs and even automate the scanning process for these API scans, using the same file formats we that we use for ZAP’s own API (JSON, etc.). However, the main problem with scanning APIs is the exploration, figuring out what to target and using which methods since most of the time browsing or spidering will not lead to useful results for APIs.

====Why is an API key required by default?====
Since ZAP can be controlled via API, we also must protect it from malicious sites or attackers that are looking to basically remotely control our ZAP installation or make changes to it. So it was decided to make the usage of an API key mandatory to hinder these attempts.

===Attack the OWASP Top 10 using ZAP===

One of the many guides found at the ZAP website is about how to attack the top 10 security threats using ZAP. The content of the following tables is taken from the [https://www.zaproxy.org/docs/guides/zapping-the-top-10/ Zapping the Top 10 Guide].

{| class="wikitable"
|+ Common Components
|-
|-
| ''Manual'' || Man-in-the-middle proxy
|-
| ''Manual'' || Manual request / resend
|-
| ''Manual'' || Scripts
|-
| ''Manual'' || Search
|}

{| class="wikitable"
|+ A1 Injection
|-
|-
| ''Automated'' || Active Scan Rules (Release, Beta*, and Alpha*)
|-
| ''Automated'' || Advanced SQLInjection Scanner* (Based on SQLMap)
|-
| ''Manual'' || Fuzzer, combined with the FuzzDb* and SVN Digger* files
|}

{| class="wikitable"
|+ A2 Broken Authentication
|-
|-
| ''Manual'' || HTTP Sessions
|-
| ''Manual'' || Spider
|-
| ''Manual'' || Forced Browse
|-
| ''Manual'' || Token Generator*
|-
| ''Automatic'' || Access Control Testing*
|}

==Modes==
ZAP has different modes to to choose from:
* Safe: only allows operations that are considered not dangerous
* Protected: the officially recommended mode, it does allow dangerous operations but only on URLs that were put in the Scope of our target
* Standard: everything goes
* ATTACK: this mode sets ZAP to scan new nodes within the Scope to be actively scanned as soon as they are discovered

===Passive versus Active Scanning===
Passive scanning is considered safe and legal, too, it is used to find vulnerabilities and none of the requests or responses change. It is also run in a background thread so it does not negatively affect the performance when exploring an application.

With Active Scanning we might actually attack our target so this should be done with caution and of course permission only, we could end up altering data at the target site with an active scan.

Limitations of a standard passive scan are that pages that require a login can not be accessed by ZAP since the authentication will not be handled by ZAP. It is, however, possible to configure the functionality to authenticate. Another limitation is that the sequence in which a passive scan explores the target is pretty much uncontrollable. But ZAP offers a solution for almost every limitation, and that means there are many extra features in ZAP for exploring and attacking other than the passive scan. For exploring a site we already mentioned spidering as a viable option but we need to keep in mind that they also are rather limited when it comes to filling out forms, they may enter default data or random strings instead of the required information. So it is suggested that spidering is used in combination with manual exploration, so that an actual user can, for example, fill out form data if an error message is returned.

Another recommendation for exploration is to take a look at the web application with a browser proxying through ZAP, the benefit of this method is that all requests and responses undergo a passive scan by ZAP and a site tree is built. Additionally, ZAP will record potential vulnerabilities that it finds for future reference.

OWASP ZAP

2020-12-18T13:14:03Z

MMuszik: /* Attack the OWASP Top 10 using ZAP */

== Introduction ==
=== About ===
ZAP is short for Zed Attack Proxy. Before we delve into details as to what this means, what it is about, why it was created and what it can be used for, let us start by having a look at the ''principles of ZAP'' first for a better understanding.

The principles are:
* It is free, open source which means anyone can access and use it.
* It is also cross platform that is it works on Linux, Windows and Macs.
* It is easy to use; any user be it beginner or a professional can use it easily.
* It is easy to install; it requires Java Runtime Environment but everything else is included in standard downloads.
* It is fully internationalized, i.e., it has been translated to many other languages.
* It is fully documented, set of useful documents and helpline files are included.
* It works well with other tools, so that we can use other tools in conjunction with zap if we need to.
* It supports the use of well-regarded components.
These principles can be seen as the motivation behind ZAP, to summarise, it is designed to give everyone interested the chance to easily run security tests, at no cost, no matter their experience, the computer they use or the language they speak.
OWASP (Open Web Application Security Project) is a non-profit organisation that publishes freely-available articles, and aside from tools like ZAP they also provide documentation and technologies that deal with web application security. A lot of other security publications refer to the OWASP publications, for example the OWASP Top 10 which is looking at the biggest security risks for organisations and which will be featured in its own chapter in this here paper later on.
They also offer a Testing guide as well as a Development guide offering best practice information to those interested and many more interesting resources.

=== Description ===
ZAP’s focus is on testing web applications, the core idea behind it is a ”Man-in-the-Middle proxy”, that is, all web traffic between the web browser and the web application is first directed through ZAP. The data and messages can be intercepted, inspected, even modified before they are forwarded to their actual destination.
There are different ways to run ZAP, it is possible to use it as a stand-alone application (Java 8+ is required) or as a daemon process.

It is also possible to run ZAP in combination with another proxy, e.g. if a company runs their web traffic through their own proxy or firewall solution first. In this case we configure our browser to connect to ZAP, and then we can configure ZAP to connect to that other proxy.

There are various Add-ons as well as an API which make it possible to be used in a variety of scenarios and also to extend ZAP further in the future.
As stated in the principles, ZAP targets all skill levels, from those new to security testing who will probably start out by using automated tests, to developers, to those that run security tests for a living and can be considered specialists, making use of a variety of features including manual tests. The flexibility and extensibility (via add-ons in the ZAP marketplace that is part of the client) that ZAP provides make it a popular choice among security testers, add to that it is available for free and for pretty much every major operating system.
Since we’re talking about security, to a lot of people it is also important to know what their security tools really do. ZAP is open source and code examination is possible if so desired, one can look at how certain functions are implemented and the developers are transparent about which data ZAP is ”sending home” (e.g. checks for new versions), and also how that background data can be controlled or even disabled (where possible).
The ZAP community is also very open to new developers, anyone can submit bug fixes or create additional features for ZAP.

==How-To==
===Installation===
[[File:Zap-installation.png|thumb|ZAP Installation]]

First, go to the [https://www.zaproxy.org/download/ Download section on the official website for ZAP] and select the installer for your operating system.

Additionally, a Java version 8 or higher must be installed. That’s pretty much it, one needs to agree to the terms of service and then ZAP is ready to go.

===Quickstart/Automated Scan===
[[File:Zap-persist session.png|thumb|ZAP Session Persistence]]
After opening ZAP you are asked if you want to persist the session. Answer "No" to quickly skip to the Quickstart.
[[File:Zap-quickstart.png|thumb|ZAP Quickstart]]
The easiest way to start using ZAP is via the Quick Start tab. Quick Start is a ZAP add-on that is included automatically when you installed ZAP.
To run a Quick Start Automated Scan:
* Start ZAP and click the Quick Start tab of the Workspace Window.
* Click the large Automated Scan button.
* In the URL to attack text box, enter the full URL of the web application you want to attack.
* Click the Attack button

===Manual Scan===
[[File:Zap-hud firefox.png|thumb|ZAP HUD Welcome Message]]
A manual scan can be done the following way:
* Start ZAP and click the Quick Start tab of the Workspace Window. (see above)
* Click the large Manual Explore button.
* In the URL to explore text box, enter the full URL of the web application you want to explore.
* Select the browser you would like to use
* Click the Launch Browser

Next you will be presented with a welcome message that includes the HUD tutorial.

===Add-Ons===
There is a so-called '''Marketplace''' for ZAP where Add-ons can be found. These make it possible to extend the functionality of ZAP even further, and typically it is possible to add or remove them without restarting the ZAP application.
Usually Add-ons are assigned one of the following states:
* Release: high-quality add-on
* Beta: reasonable quality but possibly incomplete or still requires testing • Alpha: requires further development

[[File:Zap-addons.png|thumb|Manage Add-Ons]]
You can reach the marketplace by clicking on the blue-red-green squares symbol in the UI, it stands for "Manage Add-Ons".

===User Agent Settings===
If you go to ''Tools → Options → Connection'' in the ZAP GUI you can configure the Default User Agent (as in, which browser as well as operating system) that ZAP should pretend to be when connecting to websites. You may get different responses depending on this, especially older websites did have their own configurations for Internet Explorer that were unlike those for other browsers.

=== API ===
It is possible to interact with ZAP using its powerful Application Programming Interface (API), almost every feature that the GUI offers can be accessed via API and more features are being added with future versions. It also helps not only beginners that there is an [https://www.zaproxy.org/docs/api extensive documentation] for the API, giving examples for Shell script, Python and Java commands to run features.

Requests to the API are via GET and POST endpoints, responses are available in a variety of formats such as JSON, HTML and HTML but also custom formats such as HAR. The content of the response formats is always the same but the developer can select the format that best fits their use case depending on what they are looking for. There are recommendations given such as using HTML for good readability in reports, JSON or XML if one is looking to quickly parse the returned result.

It is also possible to use ZAP to scan APIs and even automate the scanning process for these API scans, using the same file formats we that we use for ZAP’s own API (JSON, etc.). However, the main problem with scanning APIs is the exploration, figuring out what to target and using which methods since most of the time browsing or spidering will not lead to useful results for APIs.

====Why is an API key required by default?====
Since ZAP can be controlled via API, we also must protect it from malicious sites or attackers that are looking to basically remotely control our ZAP installation or make changes to it. So it was decided to make the usage of an API key mandatory to hinder these attempts.

===Attack the OWASP Top 10 using ZAP===

One of the many guides found at the ZAP website is about how to attack the top 10 security threats using ZAP. The content of the following tables is taken from the [https://www.zaproxy.org/docs/guides/zapping-the-top-10/ Zapping the Top 10 Guide].

{| class="wikitable"
|+ Common Components
|-
|-
| ''Manual'' || Man-in-the-middle proxy
|-
| ''Manual'' || Manual request / resend
|-
| ''Manual'' || Scripts
|-
| ''Manual'' || Search
|}

==Modes==
ZAP has different modes to to choose from:
* Safe: only allows operations that are considered not dangerous
* Protected: the officially recommended mode, it does allow dangerous operations but only on URLs that were put in the Scope of our target
* Standard: everything goes
* ATTACK: this mode sets ZAP to scan new nodes within the Scope to be actively scanned as soon as they are discovered

===Passive versus Active Scanning===
Passive scanning is considered safe and legal, too, it is used to find vulnerabilities and none of the requests or responses change. It is also run in a background thread so it does not negatively affect the performance when exploring an application.

With Active Scanning we might actually attack our target so this should be done with caution and of course permission only, we could end up altering data at the target site with an active scan.

Limitations of a standard passive scan are that pages that require a login can not be accessed by ZAP since the authentication will not be handled by ZAP. It is, however, possible to configure the functionality to authenticate. Another limitation is that the sequence in which a passive scan explores the target is pretty much uncontrollable. But ZAP offers a solution for almost every limitation, and that means there are many extra features in ZAP for exploring and attacking other than the passive scan. For exploring a site we already mentioned spidering as a viable option but we need to keep in mind that they also are rather limited when it comes to filling out forms, they may enter default data or random strings instead of the required information. So it is suggested that spidering is used in combination with manual exploration, so that an actual user can, for example, fill out form data if an error message is returned.

Another recommendation for exploration is to take a look at the web application with a browser proxying through ZAP, the benefit of this method is that all requests and responses undergo a passive scan by ZAP and a site tree is built. Additionally, ZAP will record potential vulnerabilities that it finds for future reference.

OWASP ZAP

2020-12-18T13:13:31Z

MMuszik: /* Attack the OWASP Top 10 using ZAP */

== Introduction ==
=== About ===
ZAP is short for Zed Attack Proxy. Before we delve into details as to what this means, what it is about, why it was created and what it can be used for, let us start by having a look at the ''principles of ZAP'' first for a better understanding.

The principles are:
* It is free, open source which means anyone can access and use it.
* It is also cross platform that is it works on Linux, Windows and Macs.
* It is easy to use; any user be it beginner or a professional can use it easily.
* It is easy to install; it requires Java Runtime Environment but everything else is included in standard downloads.
* It is fully internationalized, i.e., it has been translated to many other languages.
* It is fully documented, set of useful documents and helpline files are included.
* It works well with other tools, so that we can use other tools in conjunction with zap if we need to.
* It supports the use of well-regarded components.
These principles can be seen as the motivation behind ZAP, to summarise, it is designed to give everyone interested the chance to easily run security tests, at no cost, no matter their experience, the computer they use or the language they speak.
OWASP (Open Web Application Security Project) is a non-profit organisation that publishes freely-available articles, and aside from tools like ZAP they also provide documentation and technologies that deal with web application security. A lot of other security publications refer to the OWASP publications, for example the OWASP Top 10 which is looking at the biggest security risks for organisations and which will be featured in its own chapter in this here paper later on.
They also offer a Testing guide as well as a Development guide offering best practice information to those interested and many more interesting resources.

=== Description ===
ZAP’s focus is on testing web applications, the core idea behind it is a ”Man-in-the-Middle proxy”, that is, all web traffic between the web browser and the web application is first directed through ZAP. The data and messages can be intercepted, inspected, even modified before they are forwarded to their actual destination.
There are different ways to run ZAP, it is possible to use it as a stand-alone application (Java 8+ is required) or as a daemon process.

It is also possible to run ZAP in combination with another proxy, e.g. if a company runs their web traffic through their own proxy or firewall solution first. In this case we configure our browser to connect to ZAP, and then we can configure ZAP to connect to that other proxy.

There are various Add-ons as well as an API which make it possible to be used in a variety of scenarios and also to extend ZAP further in the future.
As stated in the principles, ZAP targets all skill levels, from those new to security testing who will probably start out by using automated tests, to developers, to those that run security tests for a living and can be considered specialists, making use of a variety of features including manual tests. The flexibility and extensibility (via add-ons in the ZAP marketplace that is part of the client) that ZAP provides make it a popular choice among security testers, add to that it is available for free and for pretty much every major operating system.
Since we’re talking about security, to a lot of people it is also important to know what their security tools really do. ZAP is open source and code examination is possible if so desired, one can look at how certain functions are implemented and the developers are transparent about which data ZAP is ”sending home” (e.g. checks for new versions), and also how that background data can be controlled or even disabled (where possible).
The ZAP community is also very open to new developers, anyone can submit bug fixes or create additional features for ZAP.

==How-To==
===Installation===
[[File:Zap-installation.png|thumb|ZAP Installation]]

First, go to the [https://www.zaproxy.org/download/ Download section on the official website for ZAP] and select the installer for your operating system.

Additionally, a Java version 8 or higher must be installed. That’s pretty much it, one needs to agree to the terms of service and then ZAP is ready to go.

===Quickstart/Automated Scan===
[[File:Zap-persist session.png|thumb|ZAP Session Persistence]]
After opening ZAP you are asked if you want to persist the session. Answer "No" to quickly skip to the Quickstart.
[[File:Zap-quickstart.png|thumb|ZAP Quickstart]]
The easiest way to start using ZAP is via the Quick Start tab. Quick Start is a ZAP add-on that is included automatically when you installed ZAP.
To run a Quick Start Automated Scan:
* Start ZAP and click the Quick Start tab of the Workspace Window.
* Click the large Automated Scan button.
* In the URL to attack text box, enter the full URL of the web application you want to attack.
* Click the Attack button

===Manual Scan===
[[File:Zap-hud firefox.png|thumb|ZAP HUD Welcome Message]]
A manual scan can be done the following way:
* Start ZAP and click the Quick Start tab of the Workspace Window. (see above)
* Click the large Manual Explore button.
* In the URL to explore text box, enter the full URL of the web application you want to explore.
* Select the browser you would like to use
* Click the Launch Browser

Next you will be presented with a welcome message that includes the HUD tutorial.

===Add-Ons===
There is a so-called '''Marketplace''' for ZAP where Add-ons can be found. These make it possible to extend the functionality of ZAP even further, and typically it is possible to add or remove them without restarting the ZAP application.
Usually Add-ons are assigned one of the following states:
* Release: high-quality add-on
* Beta: reasonable quality but possibly incomplete or still requires testing • Alpha: requires further development

[[File:Zap-addons.png|thumb|Manage Add-Ons]]
You can reach the marketplace by clicking on the blue-red-green squares symbol in the UI, it stands for "Manage Add-Ons".

===User Agent Settings===
If you go to ''Tools → Options → Connection'' in the ZAP GUI you can configure the Default User Agent (as in, which browser as well as operating system) that ZAP should pretend to be when connecting to websites. You may get different responses depending on this, especially older websites did have their own configurations for Internet Explorer that were unlike those for other browsers.

=== API ===
It is possible to interact with ZAP using its powerful Application Programming Interface (API), almost every feature that the GUI offers can be accessed via API and more features are being added with future versions. It also helps not only beginners that there is an [https://www.zaproxy.org/docs/api extensive documentation] for the API, giving examples for Shell script, Python and Java commands to run features.

Requests to the API are via GET and POST endpoints, responses are available in a variety of formats such as JSON, HTML and HTML but also custom formats such as HAR. The content of the response formats is always the same but the developer can select the format that best fits their use case depending on what they are looking for. There are recommendations given such as using HTML for good readability in reports, JSON or XML if one is looking to quickly parse the returned result.

It is also possible to use ZAP to scan APIs and even automate the scanning process for these API scans, using the same file formats we that we use for ZAP’s own API (JSON, etc.). However, the main problem with scanning APIs is the exploration, figuring out what to target and using which methods since most of the time browsing or spidering will not lead to useful results for APIs.

====Why is an API key required by default?====
Since ZAP can be controlled via API, we also must protect it from malicious sites or attackers that are looking to basically remotely control our ZAP installation or make changes to it. So it was decided to make the usage of an API key mandatory to hinder these attempts.

===Attack the OWASP Top 10 using ZAP===

One of the many guides found at the ZAP website is about how to attack the top 10 security threats using ZAP. The content of the following tables is taken from the [https://www.zaproxy.org/docs/guides/zapping-the-top-10/ Zapping the Top 10 Guide].

{| class="wikitable"
|+ Common Components
|-
|-
| '''Manual''' || Man-in-the-middle proxy
|-
| Manual || Manual request / resend
|-
| Manual || Scripts
|-
| Manual || Search
|}

==Modes==
ZAP has different modes to to choose from:
* Safe: only allows operations that are considered not dangerous
* Protected: the officially recommended mode, it does allow dangerous operations but only on URLs that were put in the Scope of our target
* Standard: everything goes
* ATTACK: this mode sets ZAP to scan new nodes within the Scope to be actively scanned as soon as they are discovered

===Passive versus Active Scanning===
Passive scanning is considered safe and legal, too, it is used to find vulnerabilities and none of the requests or responses change. It is also run in a background thread so it does not negatively affect the performance when exploring an application.

With Active Scanning we might actually attack our target so this should be done with caution and of course permission only, we could end up altering data at the target site with an active scan.

Limitations of a standard passive scan are that pages that require a login can not be accessed by ZAP since the authentication will not be handled by ZAP. It is, however, possible to configure the functionality to authenticate. Another limitation is that the sequence in which a passive scan explores the target is pretty much uncontrollable. But ZAP offers a solution for almost every limitation, and that means there are many extra features in ZAP for exploring and attacking other than the passive scan. For exploring a site we already mentioned spidering as a viable option but we need to keep in mind that they also are rather limited when it comes to filling out forms, they may enter default data or random strings instead of the required information. So it is suggested that spidering is used in combination with manual exploration, so that an actual user can, for example, fill out form data if an error message is returned.

Another recommendation for exploration is to take a look at the web application with a browser proxying through ZAP, the benefit of this method is that all requests and responses undergo a passive scan by ZAP and a site tree is built. Additionally, ZAP will record potential vulnerabilities that it finds for future reference.

OWASP ZAP

2020-12-18T13:13:13Z

MMuszik: /* How-To */

== Introduction ==
=== About ===
ZAP is short for Zed Attack Proxy. Before we delve into details as to what this means, what it is about, why it was created and what it can be used for, let us start by having a look at the ''principles of ZAP'' first for a better understanding.

The principles are:
* It is free, open source which means anyone can access and use it.
* It is also cross platform that is it works on Linux, Windows and Macs.
* It is easy to use; any user be it beginner or a professional can use it easily.
* It is easy to install; it requires Java Runtime Environment but everything else is included in standard downloads.
* It is fully internationalized, i.e., it has been translated to many other languages.
* It is fully documented, set of useful documents and helpline files are included.
* It works well with other tools, so that we can use other tools in conjunction with zap if we need to.
* It supports the use of well-regarded components.
These principles can be seen as the motivation behind ZAP, to summarise, it is designed to give everyone interested the chance to easily run security tests, at no cost, no matter their experience, the computer they use or the language they speak.
OWASP (Open Web Application Security Project) is a non-profit organisation that publishes freely-available articles, and aside from tools like ZAP they also provide documentation and technologies that deal with web application security. A lot of other security publications refer to the OWASP publications, for example the OWASP Top 10 which is looking at the biggest security risks for organisations and which will be featured in its own chapter in this here paper later on.
They also offer a Testing guide as well as a Development guide offering best practice information to those interested and many more interesting resources.

=== Description ===
ZAP’s focus is on testing web applications, the core idea behind it is a ”Man-in-the-Middle proxy”, that is, all web traffic between the web browser and the web application is first directed through ZAP. The data and messages can be intercepted, inspected, even modified before they are forwarded to their actual destination.
There are different ways to run ZAP, it is possible to use it as a stand-alone application (Java 8+ is required) or as a daemon process.

It is also possible to run ZAP in combination with another proxy, e.g. if a company runs their web traffic through their own proxy or firewall solution first. In this case we configure our browser to connect to ZAP, and then we can configure ZAP to connect to that other proxy.

There are various Add-ons as well as an API which make it possible to be used in a variety of scenarios and also to extend ZAP further in the future.
As stated in the principles, ZAP targets all skill levels, from those new to security testing who will probably start out by using automated tests, to developers, to those that run security tests for a living and can be considered specialists, making use of a variety of features including manual tests. The flexibility and extensibility (via add-ons in the ZAP marketplace that is part of the client) that ZAP provides make it a popular choice among security testers, add to that it is available for free and for pretty much every major operating system.
Since we’re talking about security, to a lot of people it is also important to know what their security tools really do. ZAP is open source and code examination is possible if so desired, one can look at how certain functions are implemented and the developers are transparent about which data ZAP is ”sending home” (e.g. checks for new versions), and also how that background data can be controlled or even disabled (where possible).
The ZAP community is also very open to new developers, anyone can submit bug fixes or create additional features for ZAP.

==How-To==
===Installation===
[[File:Zap-installation.png|thumb|ZAP Installation]]

First, go to the [https://www.zaproxy.org/download/ Download section on the official website for ZAP] and select the installer for your operating system.

Additionally, a Java version 8 or higher must be installed. That’s pretty much it, one needs to agree to the terms of service and then ZAP is ready to go.

===Quickstart/Automated Scan===
[[File:Zap-persist session.png|thumb|ZAP Session Persistence]]
After opening ZAP you are asked if you want to persist the session. Answer "No" to quickly skip to the Quickstart.
[[File:Zap-quickstart.png|thumb|ZAP Quickstart]]
The easiest way to start using ZAP is via the Quick Start tab. Quick Start is a ZAP add-on that is included automatically when you installed ZAP.
To run a Quick Start Automated Scan:
* Start ZAP and click the Quick Start tab of the Workspace Window.
* Click the large Automated Scan button.
* In the URL to attack text box, enter the full URL of the web application you want to attack.
* Click the Attack button

===Manual Scan===
[[File:Zap-hud firefox.png|thumb|ZAP HUD Welcome Message]]
A manual scan can be done the following way:
* Start ZAP and click the Quick Start tab of the Workspace Window. (see above)
* Click the large Manual Explore button.
* In the URL to explore text box, enter the full URL of the web application you want to explore.
* Select the browser you would like to use
* Click the Launch Browser

Next you will be presented with a welcome message that includes the HUD tutorial.

===Add-Ons===
There is a so-called '''Marketplace''' for ZAP where Add-ons can be found. These make it possible to extend the functionality of ZAP even further, and typically it is possible to add or remove them without restarting the ZAP application.
Usually Add-ons are assigned one of the following states:
* Release: high-quality add-on
* Beta: reasonable quality but possibly incomplete or still requires testing • Alpha: requires further development

[[File:Zap-addons.png|thumb|Manage Add-Ons]]
You can reach the marketplace by clicking on the blue-red-green squares symbol in the UI, it stands for "Manage Add-Ons".

===User Agent Settings===
If you go to ''Tools → Options → Connection'' in the ZAP GUI you can configure the Default User Agent (as in, which browser as well as operating system) that ZAP should pretend to be when connecting to websites. You may get different responses depending on this, especially older websites did have their own configurations for Internet Explorer that were unlike those for other browsers.

=== API ===
It is possible to interact with ZAP using its powerful Application Programming Interface (API), almost every feature that the GUI offers can be accessed via API and more features are being added with future versions. It also helps not only beginners that there is an [https://www.zaproxy.org/docs/api extensive documentation] for the API, giving examples for Shell script, Python and Java commands to run features.

Requests to the API are via GET and POST endpoints, responses are available in a variety of formats such as JSON, HTML and HTML but also custom formats such as HAR. The content of the response formats is always the same but the developer can select the format that best fits their use case depending on what they are looking for. There are recommendations given such as using HTML for good readability in reports, JSON or XML if one is looking to quickly parse the returned result.

It is also possible to use ZAP to scan APIs and even automate the scanning process for these API scans, using the same file formats we that we use for ZAP’s own API (JSON, etc.). However, the main problem with scanning APIs is the exploration, figuring out what to target and using which methods since most of the time browsing or spidering will not lead to useful results for APIs.

====Why is an API key required by default?====
Since ZAP can be controlled via API, we also must protect it from malicious sites or attackers that are looking to basically remotely control our ZAP installation or make changes to it. So it was decided to make the usage of an API key mandatory to hinder these attempts.

===Attack the OWASP Top 10 using ZAP===

One of the many guides found at the ZAP website is about how to attack the top 10 security threats using ZAP. The content of the following tables is taken from the [https://www.zaproxy.org/docs/guides/zapping-the-top-10/ Zapping the Top 10 Guide].

{| class="wikitable"
|+ Common Components
|-
|-
| Manual || Man-in-the-middle proxy
|-
| Manual || Manual request / resend
|-
| Manual || Scripts
|-
| Manual || Search
|}

==Modes==
ZAP has different modes to to choose from:
* Safe: only allows operations that are considered not dangerous
* Protected: the officially recommended mode, it does allow dangerous operations but only on URLs that were put in the Scope of our target
* Standard: everything goes
* ATTACK: this mode sets ZAP to scan new nodes within the Scope to be actively scanned as soon as they are discovered

===Passive versus Active Scanning===
Passive scanning is considered safe and legal, too, it is used to find vulnerabilities and none of the requests or responses change. It is also run in a background thread so it does not negatively affect the performance when exploring an application.

With Active Scanning we might actually attack our target so this should be done with caution and of course permission only, we could end up altering data at the target site with an active scan.

Limitations of a standard passive scan are that pages that require a login can not be accessed by ZAP since the authentication will not be handled by ZAP. It is, however, possible to configure the functionality to authenticate. Another limitation is that the sequence in which a passive scan explores the target is pretty much uncontrollable. But ZAP offers a solution for almost every limitation, and that means there are many extra features in ZAP for exploring and attacking other than the passive scan. For exploring a site we already mentioned spidering as a viable option but we need to keep in mind that they also are rather limited when it comes to filling out forms, they may enter default data or random strings instead of the required information. So it is suggested that spidering is used in combination with manual exploration, so that an actual user can, for example, fill out form data if an error message is returned.

Another recommendation for exploration is to take a look at the web application with a browser proxying through ZAP, the benefit of this method is that all requests and responses undergo a passive scan by ZAP and a site tree is built. Additionally, ZAP will record potential vulnerabilities that it finds for future reference.

OWASP ZAP

2020-12-18T13:05:00Z

MMuszik: /* How-To */

== Introduction ==
=== About ===
ZAP is short for Zed Attack Proxy. Before we delve into details as to what this means, what it is about, why it was created and what it can be used for, let us start by having a look at the ''principles of ZAP'' first for a better understanding.

The principles are:
* It is free, open source which means anyone can access and use it.
* It is also cross platform that is it works on Linux, Windows and Macs.
* It is easy to use; any user be it beginner or a professional can use it easily.
* It is easy to install; it requires Java Runtime Environment but everything else is included in standard downloads.
* It is fully internationalized, i.e., it has been translated to many other languages.
* It is fully documented, set of useful documents and helpline files are included.
* It works well with other tools, so that we can use other tools in conjunction with zap if we need to.
* It supports the use of well-regarded components.
These principles can be seen as the motivation behind ZAP, to summarise, it is designed to give everyone interested the chance to easily run security tests, at no cost, no matter their experience, the computer they use or the language they speak.
OWASP (Open Web Application Security Project) is a non-profit organisation that publishes freely-available articles, and aside from tools like ZAP they also provide documentation and technologies that deal with web application security. A lot of other security publications refer to the OWASP publications, for example the OWASP Top 10 which is looking at the biggest security risks for organisations and which will be featured in its own chapter in this here paper later on.
They also offer a Testing guide as well as a Development guide offering best practice information to those interested and many more interesting resources.

=== Description ===
ZAP’s focus is on testing web applications, the core idea behind it is a ”Man-in-the-Middle proxy”, that is, all web traffic between the web browser and the web application is first directed through ZAP. The data and messages can be intercepted, inspected, even modified before they are forwarded to their actual destination.
There are different ways to run ZAP, it is possible to use it as a stand-alone application (Java 8+ is required) or as a daemon process.

It is also possible to run ZAP in combination with another proxy, e.g. if a company runs their web traffic through their own proxy or firewall solution first. In this case we configure our browser to connect to ZAP, and then we can configure ZAP to connect to that other proxy.

There are various Add-ons as well as an API which make it possible to be used in a variety of scenarios and also to extend ZAP further in the future.
As stated in the principles, ZAP targets all skill levels, from those new to security testing who will probably start out by using automated tests, to developers, to those that run security tests for a living and can be considered specialists, making use of a variety of features including manual tests. The flexibility and extensibility (via add-ons in the ZAP marketplace that is part of the client) that ZAP provides make it a popular choice among security testers, add to that it is available for free and for pretty much every major operating system.
Since we’re talking about security, to a lot of people it is also important to know what their security tools really do. ZAP is open source and code examination is possible if so desired, one can look at how certain functions are implemented and the developers are transparent about which data ZAP is ”sending home” (e.g. checks for new versions), and also how that background data can be controlled or even disabled (where possible).
The ZAP community is also very open to new developers, anyone can submit bug fixes or create additional features for ZAP.

==How-To==
===Installation===
[[File:Zap-installation.png|thumb|ZAP Installation]]

First, go to the [https://www.zaproxy.org/download/ Download section on the official website for ZAP] and select the installer for your operating system.

Additionally, a Java version 8 or higher must be installed. That’s pretty much it, one needs to agree to the terms of service and then ZAP is ready to go.

===Quickstart/Automated Scan===
[[File:Zap-persist session.png|thumb|ZAP Session Persistence]]
After opening ZAP you are asked if you want to persist the session. Answer "No" to quickly skip to the Quickstart.
[[File:Zap-quickstart.png|thumb|ZAP Quickstart]]
The easiest way to start using ZAP is via the Quick Start tab. Quick Start is a ZAP add-on that is included automatically when you installed ZAP.
To run a Quick Start Automated Scan:
* Start ZAP and click the Quick Start tab of the Workspace Window.
* Click the large Automated Scan button.
* In the URL to attack text box, enter the full URL of the web application you want to attack.
* Click the Attack button

===Manual Scan===
[[File:Zap-hud firefox.png|thumb|ZAP HUD Welcome Message]]
A manual scan can be done the following way:
* Start ZAP and click the Quick Start tab of the Workspace Window. (see above)
* Click the large Manual Explore button.
* In the URL to explore text box, enter the full URL of the web application you want to explore.
* Select the browser you would like to use
* Click the Launch Browser

Next you will be presented with a welcome message that includes the HUD tutorial.

===Add-Ons===
There is a so-called '''Marketplace''' for ZAP where Add-ons can be found. These make it possible to extend the functionality of ZAP even further, and typically it is possible to add or remove them without restarting the ZAP application.
Usually Add-ons are assigned one of the following states:
* Release: high-quality add-on
* Beta: reasonable quality but possibly incomplete or still requires testing • Alpha: requires further development

[[File:Zap-addons.png|thumb|Manage Add-Ons]]
You can reach the marketplace by clicking on the blue-red-green squares symbol in the UI, it stands for "Manage Add-Ons".

===User Agent Settings===
If you go to ''Tools → Options → Connection'' in the ZAP GUI you can configure the Default User Agent (as in, which browser as well as operating system) that ZAP should pretend to be when connecting to websites. You may get different responses depending on this, especially older websites did have their own configurations for Internet Explorer that were unlike those for other browsers.

=== API ===
It is possible to interact with ZAP using its powerful Application Programming Interface (API), almost every feature that the GUI offers can be accessed via API and more features are being added with future versions. It also helps not only beginners that there is an [https://www.zaproxy.org/docs/api extensive documentation] for the API, giving examples for Shell script, Python and Java commands to run features.

Requests to the API are via GET and POST endpoints, responses are available in a variety of formats such as JSON, HTML and HTML but also custom formats such as HAR. The content of the response formats is always the same but the developer can select the format that best fits their use case depending on what they are looking for. There are recommendations given such as using HTML for good readability in reports, JSON or XML if one is looking to quickly parse the returned result.

It is also possible to use ZAP to scan APIs and even automate the scanning process for these API scans, using the same file formats we that we use for ZAP’s own API (JSON, etc.). However, the main problem with scanning APIs is the exploration, figuring out what to target and using which methods since most of the time browsing or spidering will not lead to useful results for APIs.

====Why is an API key required by default?====
Since ZAP can be controlled via API, we also must protect it from malicious sites or attackers that are looking to basically remotely control our ZAP installation or make changes to it. So it was decided to make the usage of an API key mandatory to hinder these attempts.

==Modes==
ZAP has different modes to to choose from:
* Safe: only allows operations that are considered not dangerous
* Protected: the officially recommended mode, it does allow dangerous operations but only on URLs that were put in the Scope of our target
* Standard: everything goes
* ATTACK: this mode sets ZAP to scan new nodes within the Scope to be actively scanned as soon as they are discovered

===Passive versus Active Scanning===
Passive scanning is considered safe and legal, too, it is used to find vulnerabilities and none of the requests or responses change. It is also run in a background thread so it does not negatively affect the performance when exploring an application.

With Active Scanning we might actually attack our target so this should be done with caution and of course permission only, we could end up altering data at the target site with an active scan.

Limitations of a standard passive scan are that pages that require a login can not be accessed by ZAP since the authentication will not be handled by ZAP. It is, however, possible to configure the functionality to authenticate. Another limitation is that the sequence in which a passive scan explores the target is pretty much uncontrollable. But ZAP offers a solution for almost every limitation, and that means there are many extra features in ZAP for exploring and attacking other than the passive scan. For exploring a site we already mentioned spidering as a viable option but we need to keep in mind that they also are rather limited when it comes to filling out forms, they may enter default data or random strings instead of the required information. So it is suggested that spidering is used in combination with manual exploration, so that an actual user can, for example, fill out form data if an error message is returned.

Another recommendation for exploration is to take a look at the web application with a browser proxying through ZAP, the benefit of this method is that all requests and responses undergo a passive scan by ZAP and a site tree is built. Additionally, ZAP will record potential vulnerabilities that it finds for future reference.

OWASP ZAP

2020-12-18T13:03:29Z

MMuszik: /* Manual Scan */

File:Zap-hud firefox.png

2020-12-18T13:02:06Z

MMuszik: Screenshot of ZAP head-up-display (HUD) in Firefox Browser taken by MMuzik

== Summary ==
Screenshot of ZAP head-up-display (HUD) in Firefox Browser taken by MMuzik

OWASP ZAP

2020-12-18T13:01:31Z

MMuszik: /* Quickstart */

OWASP ZAP

2020-12-18T12:54:37Z

MMuszik: /* How-To */

File:Zap-installation.png

2020-12-18T12:54:11Z

MMuszik:

OWASP ZAP

2020-12-18T12:51:09Z

MMuszik: /* How-To */

OWASP ZAP

2020-12-18T12:49:46Z

MMuszik: /* How-To */

OWASP ZAP

2020-12-18T12:42:24Z

MMuszik: /* How-To */

File:Zap-addons.png

2020-12-18T12:38:37Z

MMuszik: Screenshot of ZAP UI taken by MMuzik

== Summary ==
Screenshot of ZAP UI taken by MMuzik

OWASP ZAP

2020-12-18T12:38:06Z

MMuszik: /* How-To */

OWASP ZAP

2020-12-18T12:26:55Z

MMuszik:

File:Zap-persist session.png

2020-12-18T12:26:03Z

MMuszik: After starting up the ZAP application you are presented with this window asking if you want to persist (save) your session details or not.

== Summary ==
After starting up the ZAP application you are presented with this window asking if you want to persist (save) your session details or not.

OWASP ZAP

2020-12-18T12:25:05Z

MMuszik: /* Quickstart */

OWASP ZAP

2020-12-18T12:23:19Z

MMuszik: /* Quickstart */

OWASP ZAP

2020-12-18T12:21:02Z

MMuszik: /* Quickstart */

OWASP ZAP

2020-12-18T12:20:42Z

MMuszik: /* Quickstart */

OWASP ZAP

2020-12-18T12:20:22Z

MMuszik: /* Quickstart */

File:Zap-quickstart.png

2020-12-18T12:18:41Z

MMuszik: Screenshot of ZAP Quickstart taken by MMuzik

== Summary ==
Screenshot of ZAP Quickstart taken by MMuzik

OWASP ZAP

2020-12-18T12:17:20Z

MMuszik: /* Introduction/About */

OWASP ZAP

2020-12-18T12:01:05Z

MMuszik: Created page with "== Introduction/About == ZAP is short for Zed Attack Proxy. Before we delve into details as to what this means, what it is about, why it was created and what it can be used fo..."

== Introduction/About ==
ZAP is short for Zed Attack Proxy. Before we delve into details as to what this means, what it is about, why it was created and what it can be used for, let us start by having a look at the ''principles of ZAP'' first for a better understanding.

The principles are:
* It is free, open source which means anyone can access and use it.
* It is also cross platform that is it works on Linux, Windows and Macs.
* It is easy to use; any user be it beginner or a professional can use it easily.
* It is easy to install; it requires Java Runtime Environment but everything else is included in standard downloads.
* It is fully internationalized, i.e., it has been translated to many other languages.
* It is fully documented, set of useful documents and helpline files are included.
* It works well with other tools, so that we can use other tools in conjunction with zap if we need to.
* It supports the use of well-regarded components.
These principles can be seen as the motivation behind ZAP, to summarise, it is designed to give everyone interested the chance to easily run security tests, at no cost, no matter their experience, the computer they use or the language they speak.
OWASP (Open Web Application Security Project) is a non-profit organisation that publishes freely-available articles, and aside from tools like ZAP they also provide documentation and technologies that deal with web application security. A lot of other security publications refer to the OWASP publications, for example the OWASP Top 10 which is looking at the biggest security risks for organisations and which will be featured in its own chapter in this here paper later on.
They also offer a Testing guide as well as a Development guide offering best practice information to those interested and many more interesting resources.

Install c't'-Raspion on Raspberry PI

2020-06-09T08:40:00Z

MMuszik: /* Turning devices on/off */

== Requirements ==
* Raspberry PI with Raspbian OS
* Internet connection

== Description ==

=== Step 1: System Update ===

In the command line interface enter:

sudo apt-get update && sudo apt-get upgrade

=== Step 2: Download ===
Download the latest version of Raspion:

wget ct.de/s/x5Pm -O raspion.zip

=== Step 3: Installation ===
Unzip:
unzip raspion.zip

Install:
cd raspion
./install.sh or bash install.sh

[[File:Install_Raspion.png]]

At the end of the installation there is the wifi name and password of the c't-Raspion.

=== Launch c't-Raspion web interface ===
Atfer connecting to the wifi of the c't'-Raspion go to http://<ip-address of your Raspberry-PI>:81

[[File:Raspion_webinterface.png]]

== Services of the c't-Raspion ==

=== Pi-hole ===
Pi-hole shows DNS-Requests. They can also be blocked.

=== ntopng ===
They include the
involved communication partners, the network protocol and information on duration and volume. ntopng does not show the contents of the packages. But it analyses the flows and provides information about which application is communicating, such as Skype, BitTorrent etc., and provides statistics.

=== Wireshark ===
Wireshark offers a deeper analysis of the network traffic as ntopng. The program allows recording and analyzing network traffic down to the last bit and can be operated via browser as a special feature of c't-Raspion. The recorded network traffic will be saved in pcap-files.

=== mitmproxy ===
The mitm-Proxy can loop into the communication between the local and remote devices by the c't-Raspion redirecting all access from the internal network on TCP ports 80 and 443 to the mitm-Proxy. It takes the redirected accesses to port
8080 towards. The redirection is handled by firewall rules, which can be activated and deactivated as required by clicking in the c't-Raspion web interface.

== Ikea Tradfri Setup Sniff ==
For testing purposes an iphone was cleaned as far as possible. All uninstalable services were erased and synchronization plans were deactivated.
However iphones are not that good for this kind of tests because after all cleaning there were still some connections to apple servers.

To use pihole for capturing the dns queries of the Tradfri Gateway itself you may use an USB networkadapter or an external router as wifi bride. Otherwise you cannot use the Tradfri Gateway due to the lack of connection possibilities. As an workaround outside the Raspion software package classic arpspoofing was used.

Preliminary overview IP addressess:

[[File:ip-config.png|900px]]

Immediately after power on the app is sending dns requests to get ip addresses for fw.ota.homesmart.ikea.net. In the dns answer the ip's to d262cmbxmzphsu.cloudfront.net were included which is an address belonging to amazons aws.

[[File:wireshark-cap1.png|700px]]
[[File:wireshark-cap2.png|700px]]

Also an http get request can be found:
[[File:wireshark-cap-http.png|600px]]

The data from fw.ota.homesmart.ikea.net/feed/version_info.json are not that spectacular. As the name implies it only consists of version information.

As soon as the Ikea Smart Home App starts the setup it tries to find a Tradfri Gateway with mDNS queries.

[[File:wireshark-cap-mDNS.png|550px]]

The mDNS queries are not forwarded through our pihole setup so this technique finding the Tradfri Gateway fails. The app itself provides another way to find the Tradfri Gateway by entering the ip address directly. After submitting the input the app finds the gateway and asks you to scan the QR code on the bottom side of the divce or to enter the security code which can be found near the QR code.

The QR code contains the security code which is used as the pre shared key of the DTLS connection. As soon as the app gets the security code the app and the gateway are initiating the DTLS connection. All applicationdata is send over this encrypted connection.

[[File:wireshark-cap-dtls.png|550px]]

Same implies to connections of additional smart home devices: All data is sent over the encrypted connection.

[[File:wireshark-cap-dtls-snap.png|550px]]

As far as the initial setup goes there are only a few connections to the internet. This connections are all from app to some aws cloud addresses. It seems this is relating to the setup of a new device:

[[File:wireshark-cap-aws.png|550px]]

== Data Transmission when using TRADFRI ==

The IKEA TRADFRI Gateway was connected via LAN cable while the mobile phone running the IKEA app was connected wirelessly to the same network.
Overview of IP addresses used:

[[File:ip_overview_muzik.png|550px]]

Wireshark was used to record the traffic (using arpspoof because the IKEA TRADFRI Gateway requires a LAN connection so it is not possible to just monitor the Raspion WiFi) which was then filtered.

It turns out that TRADFRI is rather well-behaved when it comes to sending data.

For the most part it uses encrypted (DTLS) communication internally between the Gateway and the mobile phone. To initially find the Gateway after opening the mobile app, an MDNS request is sent out via multicast (224.x.x.x).

However, 2 external connections or destinations could also be found:

* IP address 13.227.156.82 / privacypolicy.config.homesmart.ikea.net (as the url indicates, this has the current policy one has to agree to before using the app)
* IP address 13.227.156.50 / supportdetails.config.homesmart.ikea.net (this is where the secure certificates are located, apparently).

=== Wireshark caps ===
privacypolicy.config.homesmart.ikea.net Client Hello:

[[File:Ikea-privacy policy-clientHello.png|700px]]

supportdetails.config.homesmart.ikea.net ServerHello:

[[File:Ikea-supportdetails-serverHello.png|700px]]

=== Certificate Information ===
The Server Hello contains the information regarding the .cer and .crl:
http://ocsp.rootca1.amazontrust.com
http://crt.rootca1.amazontrust.com/rootca1.cer
http://crl.rootca1.amazontrust.com/rootca1.crl
Starfield Technologies, Inc.; Starfield Services Root Certificate Authority

Also:
http://crl.sca1b.amazontrust.com/sca1b.crl
http://ocsp.sca1b.amazontrust.com
http://crt.sca1b.amazontrust.com/sca1b.crt

That's pretty much it. We couldn't find any unwanted connections.

The app also checks for updates for the used devices, this is also indicated in the app when it happens, so this is very transparent. It is indicated in the app when an update is happening or when the app is checking for new updates as can be seen in the screenshot below. If a device happens to be unavailable, e.g. because it is currently disconnected/turned off, then the app does not report back the current version but instead says the device is unreachable ('Nicht erreichbar')

[[File:Ikea-tradfri-update.png|360px]]

=== Turning devices on/off ===
When devices are turned on or off, the individual packet sequences are made up of packets that are the same in size but with some devices there are more packets sent when turning on than off. Let me illustrate this by comparing the on/off sequences of the light bulb (pretty much the same for on/off, although of course different packet content):

Light Bulb ON 
[[File:Ikea-gluehbirne_ein.png|700px]]

Light Bulb OFF 
[[File:Ikea-gluehbirne_aus.png|700px]]

As opposed to the smart plug where the on sequence is longer than the off sequence:

Smart Plug ON 
[[File:Ikea-strom ein.png|700px]]

Smart Plug OFF 
[[File:Ikea-strom aus.png|700px]]

(these were done using arpspoof on 192.168.0.106, 192.168.0.101 is the Internet Gateway, 192.168.0.104 is the TRADFRI Gateway, commands were sent via 192.168.0.103 - so keep in mind that you see duplicates of each packet in the Wireshark caps because they include the sniff and forward to the actual target device)

== Interrupt Communication ==
This experiment will show if it is possible to interrupt or sniff the communication between the IKEA and the IKEA gateway. This is not possible with only a packet sniffer like Wireshark, because the communication is encrypted with DTLS. Two attacks were performed, a mitm proxy attack and a replay attack. For the mitm attack the mitm proxy from the c’t Raspion was used and for the replay attack a scapy script. The network structure is as follows:

IP overview:

[[File:mitm_findings.png|700px]]

=== Structure ===
[[File:mitm-top.png|800px]]

Android can be operated as a virtual machine, or you can also use a smart phone that has the IKEA Smarthome app installed. If it is operated as a virtual machine, make sure that bridge mode is used, since the VM will then have its own IP. This has the advantage that you only have to analyze the traffic generated by Android and not that of the host system.

In order to be able to use the mitm, certificates must be added to the key store on the android os. This can be done by opening the website mitm.it in the browser of android. If you are in the right network, you will see the following window.

[[File:mitmproxy-cert.png|800px]]

Here you choose the right operating system and download the certificates.

The official documentation can be found here[https://docs.mitmproxy.org/stable/concepts-certificates/#quick-setup].

=== MitM Proxy ===
When you start the app in Wireshark you can see that the handshake for the DTLS connection is being carried out.

[[File:wireshark-dtls.png]]

You can also observe that there are several connections to different servers outside the network.

[[File:wireshark-tls.png]]

The following messages can be decrypted.

[[File:mitm-sniff.png]]

Both include a JSON-file.

[[File:Json-file-mitm.jpg]]

* In the debug log, you can observe that there are additional TLS connections, but the mitm proxy couldn’t decrypt these.

[[File:Debug-log-mitm.jpg]]

The DTLS connection between the app and the gateway, however, does not appear in the mitm log.

=== Replay-Attack ===
In order to be able to carry out a replay attack, the data traffic between the device on which the IKEA app is running and the IKEA gateway must be recorded. Then the SRC and DST in IP and MAC have to be adjusted accordingly. In this particular example, a sequence number is available in the DTLS protocol. This must also be adjusted so that it is preliminary. Since the payload is also included in the UDP checksum, it must be recalculated too.

[[File:replay-attack.png]]

As you can see, the attack is unsuccessful because no response is sent from the gateway, which is likely to drop the packets.

This may be because DTLS also uses MAC (message authentication code). The sequence number is used to calculate the MAC value. Unfortunately, this value cannot be recalculated without knowing the encryption.

Install c't'-Raspion on Raspberry PI

2020-06-09T08:37:17Z

MMuszik: /* Interrupt Communication */

== Requirements ==
* Raspberry PI with Raspbian OS
* Internet connection

== Description ==

=== Step 1: System Update ===

In the command line interface enter:

sudo apt-get update && sudo apt-get upgrade

=== Step 2: Download ===
Download the latest version of Raspion:

wget ct.de/s/x5Pm -O raspion.zip

=== Step 3: Installation ===
Unzip:
unzip raspion.zip

Install:
cd raspion
./install.sh or bash install.sh

[[File:Install_Raspion.png]]

At the end of the installation there is the wifi name and password of the c't-Raspion.

=== Launch c't-Raspion web interface ===
Atfer connecting to the wifi of the c't'-Raspion go to http://<ip-address of your Raspberry-PI>:81

[[File:Raspion_webinterface.png]]

== Services of the c't-Raspion ==

=== Pi-hole ===
Pi-hole shows DNS-Requests. They can also be blocked.

=== ntopng ===
They include the
involved communication partners, the network protocol and information on duration and volume. ntopng does not show the contents of the packages. But it analyses the flows and provides information about which application is communicating, such as Skype, BitTorrent etc., and provides statistics.

=== Wireshark ===
Wireshark offers a deeper analysis of the network traffic as ntopng. The program allows recording and analyzing network traffic down to the last bit and can be operated via browser as a special feature of c't-Raspion. The recorded network traffic will be saved in pcap-files.

=== mitmproxy ===
The mitm-Proxy can loop into the communication between the local and remote devices by the c't-Raspion redirecting all access from the internal network on TCP ports 80 and 443 to the mitm-Proxy. It takes the redirected accesses to port
8080 towards. The redirection is handled by firewall rules, which can be activated and deactivated as required by clicking in the c't-Raspion web interface.

== Ikea Tradfri Setup Sniff ==
For testing purposes an iphone was cleaned as far as possible. All uninstalable services were erased and synchronization plans were deactivated.
However iphones are not that good for this kind of tests because after all cleaning there were still some connections to apple servers.

To use pihole for capturing the dns queries of the Tradfri Gateway itself you may use an USB networkadapter or an external router as wifi bride. Otherwise you cannot use the Tradfri Gateway due to the lack of connection possibilities. As an workaround outside the Raspion software package classic arpspoofing was used.

Preliminary overview IP addressess:

[[File:ip-config.png|900px]]

Immediately after power on the app is sending dns requests to get ip addresses for fw.ota.homesmart.ikea.net. In the dns answer the ip's to d262cmbxmzphsu.cloudfront.net were included which is an address belonging to amazons aws.

[[File:wireshark-cap1.png|700px]]
[[File:wireshark-cap2.png|700px]]

Also an http get request can be found:
[[File:wireshark-cap-http.png|600px]]

The data from fw.ota.homesmart.ikea.net/feed/version_info.json are not that spectacular. As the name implies it only consists of version information.

As soon as the Ikea Smart Home App starts the setup it tries to find a Tradfri Gateway with mDNS queries.

[[File:wireshark-cap-mDNS.png|550px]]

The mDNS queries are not forwarded through our pihole setup so this technique finding the Tradfri Gateway fails. The app itself provides another way to find the Tradfri Gateway by entering the ip address directly. After submitting the input the app finds the gateway and asks you to scan the QR code on the bottom side of the divce or to enter the security code which can be found near the QR code.

The QR code contains the security code which is used as the pre shared key of the DTLS connection. As soon as the app gets the security code the app and the gateway are initiating the DTLS connection. All applicationdata is send over this encrypted connection.

[[File:wireshark-cap-dtls.png|550px]]

Same implies to connections of additional smart home devices: All data is sent over the encrypted connection.

[[File:wireshark-cap-dtls-snap.png|550px]]

As far as the initial setup goes there are only a few connections to the internet. This connections are all from app to some aws cloud addresses. It seems this is relating to the setup of a new device:

[[File:wireshark-cap-aws.png|550px]]

== Data Transmission when using TRADFRI ==

The IKEA TRADFRI Gateway was connected via LAN cable while the mobile phone running the IKEA app was connected wirelessly to the same network.
Overview of IP addresses used:

[[File:ip_overview_muzik.png|550px]]

Wireshark was used to record the traffic (using arpspoof because the IKEA TRADFRI Gateway requires a LAN connection so it is not possible to just monitor the Raspion WiFi) which was then filtered.

It turns out that TRADFRI is rather well-behaved when it comes to sending data.

For the most part it uses encrypted (DTLS) communication internally between the Gateway and the mobile phone. To initially find the Gateway after opening the mobile app, an MDNS request is sent out via multicast (224.x.x.x).

However, 2 external connections or destinations could also be found:

* IP address 13.227.156.82 / privacypolicy.config.homesmart.ikea.net (as the url indicates, this has the current policy one has to agree to before using the app)
* IP address 13.227.156.50 / supportdetails.config.homesmart.ikea.net (this is where the secure certificates are located, apparently).

=== Wireshark caps ===
privacypolicy.config.homesmart.ikea.net Client Hello:

[[File:Ikea-privacy policy-clientHello.png|700px]]

supportdetails.config.homesmart.ikea.net ServerHello:

[[File:Ikea-supportdetails-serverHello.png|700px]]

=== Certificate Information ===
The Server Hello contains the information regarding the .cer and .crl:
http://ocsp.rootca1.amazontrust.com
http://crt.rootca1.amazontrust.com/rootca1.cer
http://crl.rootca1.amazontrust.com/rootca1.crl
Starfield Technologies, Inc.; Starfield Services Root Certificate Authority

Also:
http://crl.sca1b.amazontrust.com/sca1b.crl
http://ocsp.sca1b.amazontrust.com
http://crt.sca1b.amazontrust.com/sca1b.crt

That's pretty much it. We couldn't find any unwanted connections.

The app also checks for updates for the used devices, this is also indicated in the app when it happens, so this is very transparent. It is indicated in the app when an update is happening or when the app is checking for new updates as can be seen in the screenshot below. If a device happens to be unavailable, e.g. because it is currently disconnected/turned off, then the app does not report back the current version but instead says the device is unreachable ('Nicht erreichbar')

[[File:Ikea-tradfri-update.png|360px]]

=== Turning devices on/off ===
When devices are turned on or off, the individual packet sequences are made up of packets that are the same in size but with some devices there are more packets sent when turning on than off. Let me illustrate this by comparing the on/off sequences of the light bulb (pretty much the same for on/off, although of course different packet content):

Light Bulb ON 
[[File:Ikea-gluehbirne_ein.png|700px]]

Light Bulb OFF 
[[File:Ikea-gluehbirne_aus.png|700px]]

As opposed to the smart plug where the on sequence is 12 packets (versus 8 packets for "off"):

Smart Plug ON 
[[File:Ikea-strom ein.png|700px]]

Smart Plug OFF 
[[File:Ikea-strom aus.png|700px]]

(these were done using arpspoof on 192.168.0.106, 192.168.0.101 is the Internet Gateway, 192.168.0.104 is the TRADFRI Gateway, commands were sent via 192.168.0.103)

== Interrupt Communication ==
This experiment will show if it is possible to interrupt or sniff the communication between the IKEA and the IKEA gateway. This is not possible with only a packet sniffer like Wireshark, because the communication is encrypted with DTLS. Two attacks were performed, a mitm proxy attack and a replay attack. For the mitm attack the mitm proxy from the c’t Raspion was used and for the replay attack a scapy script. The network structure is as follows:

IP overview:

[[File:mitm_findings.png|700px]]

=== Structure ===
[[File:mitm-top.png|800px]]

Android can be operated as a virtual machine, or you can also use a smart phone that has the IKEA Smarthome app installed. If it is operated as a virtual machine, make sure that bridge mode is used, since the VM will then have its own IP. This has the advantage that you only have to analyze the traffic generated by Android and not that of the host system.

In order to be able to use the mitm, certificates must be added to the key store on the android os. This can be done by opening the website mitm.it in the browser of android. If you are in the right network, you will see the following window.

[[File:mitmproxy-cert.png|800px]]

Here you choose the right operating system and download the certificates.

The official documentation can be found here[https://docs.mitmproxy.org/stable/concepts-certificates/#quick-setup].

=== MitM Proxy ===
When you start the app in Wireshark you can see that the handshake for the DTLS connection is being carried out.

[[File:wireshark-dtls.png]]

You can also observe that there are several connections to different servers outside the network.

[[File:wireshark-tls.png]]

The following messages can be decrypted.

[[File:mitm-sniff.png]]

Both include a JSON-file.

[[File:Json-file-mitm.jpg]]

* In the debug log, you can observe that there are additional TLS connections, but the mitm proxy couldn’t decrypt these.

[[File:Debug-log-mitm.jpg]]

The DTLS connection between the app and the gateway, however, does not appear in the mitm log.

=== Replay-Attack ===
In order to be able to carry out a replay attack, the data traffic between the device on which the IKEA app is running and the IKEA gateway must be recorded. Then the SRC and DST in IP and MAC have to be adjusted accordingly. In this particular example, a sequence number is available in the DTLS protocol. This must also be adjusted so that it is preliminary. Since the payload is also included in the UDP checksum, it must be recalculated too.

[[File:replay-attack.png]]

As you can see, the attack is unsuccessful because no response is sent from the gateway, which is likely to drop the packets.

This may be because DTLS also uses MAC (message authentication code). The sequence number is used to calculate the MAC value. Unfortunately, this value cannot be recalculated without knowing the encryption.

Install c't'-Raspion on Raspberry PI

2020-06-09T08:35:55Z

MMuszik: /* MitM Proxy */

== Requirements ==
* Raspberry PI with Raspbian OS
* Internet connection

== Description ==

=== Step 1: System Update ===

In the command line interface enter:

sudo apt-get update && sudo apt-get upgrade

=== Step 2: Download ===
Download the latest version of Raspion:

wget ct.de/s/x5Pm -O raspion.zip

=== Step 3: Installation ===
Unzip:
unzip raspion.zip

Install:
cd raspion
./install.sh or bash install.sh

[[File:Install_Raspion.png]]

At the end of the installation there is the wifi name and password of the c't-Raspion.

=== Launch c't-Raspion web interface ===
Atfer connecting to the wifi of the c't'-Raspion go to http://<ip-address of your Raspberry-PI>:81

[[File:Raspion_webinterface.png]]

== Services of the c't-Raspion ==

=== Pi-hole ===
Pi-hole shows DNS-Requests. They can also be blocked.

=== ntopng ===
They include the
involved communication partners, the network protocol and information on duration and volume. ntopng does not show the contents of the packages. But it analyses the flows and provides information about which application is communicating, such as Skype, BitTorrent etc., and provides statistics.

=== Wireshark ===
Wireshark offers a deeper analysis of the network traffic as ntopng. The program allows recording and analyzing network traffic down to the last bit and can be operated via browser as a special feature of c't-Raspion. The recorded network traffic will be saved in pcap-files.

=== mitmproxy ===
The mitm-Proxy can loop into the communication between the local and remote devices by the c't-Raspion redirecting all access from the internal network on TCP ports 80 and 443 to the mitm-Proxy. It takes the redirected accesses to port
8080 towards. The redirection is handled by firewall rules, which can be activated and deactivated as required by clicking in the c't-Raspion web interface.

== Ikea Tradfri Setup Sniff ==
For testing purposes an iphone was cleaned as far as possible. All uninstalable services were erased and synchronization plans were deactivated.
However iphones are not that good for this kind of tests because after all cleaning there were still some connections to apple servers.

To use pihole for capturing the dns queries of the Tradfri Gateway itself you may use an USB networkadapter or an external router as wifi bride. Otherwise you cannot use the Tradfri Gateway due to the lack of connection possibilities. As an workaround outside the Raspion software package classic arpspoofing was used.

Preliminary overview IP addressess:

[[File:ip-config.png|900px]]

Immediately after power on the app is sending dns requests to get ip addresses for fw.ota.homesmart.ikea.net. In the dns answer the ip's to d262cmbxmzphsu.cloudfront.net were included which is an address belonging to amazons aws.

[[File:wireshark-cap1.png|700px]]
[[File:wireshark-cap2.png|700px]]

Also an http get request can be found:
[[File:wireshark-cap-http.png|600px]]

The data from fw.ota.homesmart.ikea.net/feed/version_info.json are not that spectacular. As the name implies it only consists of version information.

As soon as the Ikea Smart Home App starts the setup it tries to find a Tradfri Gateway with mDNS queries.

[[File:wireshark-cap-mDNS.png|550px]]

The mDNS queries are not forwarded through our pihole setup so this technique finding the Tradfri Gateway fails. The app itself provides another way to find the Tradfri Gateway by entering the ip address directly. After submitting the input the app finds the gateway and asks you to scan the QR code on the bottom side of the divce or to enter the security code which can be found near the QR code.

The QR code contains the security code which is used as the pre shared key of the DTLS connection. As soon as the app gets the security code the app and the gateway are initiating the DTLS connection. All applicationdata is send over this encrypted connection.

[[File:wireshark-cap-dtls.png|550px]]

Same implies to connections of additional smart home devices: All data is sent over the encrypted connection.

[[File:wireshark-cap-dtls-snap.png|550px]]

As far as the initial setup goes there are only a few connections to the internet. This connections are all from app to some aws cloud addresses. It seems this is relating to the setup of a new device:

[[File:wireshark-cap-aws.png|550px]]

== Data Transmission when using TRADFRI ==

The IKEA TRADFRI Gateway was connected via LAN cable while the mobile phone running the IKEA app was connected wirelessly to the same network.
Overview of IP addresses used:

[[File:ip_overview_muzik.png|550px]]

Wireshark was used to record the traffic (using arpspoof because the IKEA TRADFRI Gateway requires a LAN connection so it is not possible to just monitor the Raspion WiFi) which was then filtered.

It turns out that TRADFRI is rather well-behaved when it comes to sending data.

For the most part it uses encrypted (DTLS) communication internally between the Gateway and the mobile phone. To initially find the Gateway after opening the mobile app, an MDNS request is sent out via multicast (224.x.x.x).

However, 2 external connections or destinations could also be found:

* IP address 13.227.156.82 / privacypolicy.config.homesmart.ikea.net (as the url indicates, this has the current policy one has to agree to before using the app)
* IP address 13.227.156.50 / supportdetails.config.homesmart.ikea.net (this is where the secure certificates are located, apparently).

=== Wireshark caps ===
privacypolicy.config.homesmart.ikea.net Client Hello:

[[File:Ikea-privacy policy-clientHello.png|700px]]

supportdetails.config.homesmart.ikea.net ServerHello:

[[File:Ikea-supportdetails-serverHello.png|700px]]

=== Certificate Information ===
The Server Hello contains the information regarding the .cer and .crl:
http://ocsp.rootca1.amazontrust.com
http://crt.rootca1.amazontrust.com/rootca1.cer
http://crl.rootca1.amazontrust.com/rootca1.crl
Starfield Technologies, Inc.; Starfield Services Root Certificate Authority

Also:
http://crl.sca1b.amazontrust.com/sca1b.crl
http://ocsp.sca1b.amazontrust.com
http://crt.sca1b.amazontrust.com/sca1b.crt

That's pretty much it. We couldn't find any unwanted connections.

The app also checks for updates for the used devices, this is also indicated in the app when it happens, so this is very transparent. It is indicated in the app when an update is happening or when the app is checking for new updates as can be seen in the screenshot below. If a device happens to be unavailable, e.g. because it is currently disconnected/turned off, then the app does not report back the current version but instead says the device is unreachable ('Nicht erreichbar')

[[File:Ikea-tradfri-update.png|360px]]

=== Turning devices on/off ===
When devices are turned on or off, the individual packet sequences are made up of packets that are the same in size but with some devices there are more packets sent when turning on than off. Let me illustrate this by comparing the on/off sequences of the light bulb (pretty much the same for on/off, although of course different packet content):

Light Bulb ON 
[[File:Ikea-gluehbirne_ein.png|700px]]

Light Bulb OFF 
[[File:Ikea-gluehbirne_aus.png|700px]]

As opposed to the smart plug where the on sequence is 12 packets (versus 8 packets for "off"):

Smart Plug ON 
[[File:Ikea-strom ein.png|700px]]

Smart Plug OFF 
[[File:Ikea-strom aus.png|700px]]

(these were done using arpspoof on 192.168.0.106, 192.168.0.101 is the Internet Gateway, 192.168.0.104 is the TRADFRI Gateway, commands were sent via 192.168.0.103)

== Interrupt Communication ==
This experiment will show if it is possible to interrupt or sniff the communication between the IKEA and the IKEA gateway. This is not possible with only a packet sniffer like Wireshark, because the communication is encrypt with DTLS. Two attacks where performed, a mitm proxy attack and a replay attack. For the mitm attack the mitm proxy from the c’t Raspion was used and for the replay attack a scapy script. The network structure is as follows:

IP overview:

[[File:mitm_findings.png|700px]]

=== Structure ===
[[File:mitm-top.png|800px]]

Android can be operated as a virtual machine, or you can also use a smart phone that has the IKEA Smarthome app installed. If it is operated as a virtual machine, make sure that bridge mode is used, since the VM will then have its own IP. This has the advantage that you only have to analyze the traffic generated by Android and not that of the host system.

In order to be able to use the mitm, certificates must be added to the key store on the android os. This can be done by opening the website mitm.it in the browser of android. If you are in the right network, you will see the following window.

[[File:mitmproxy-cert.png|800px]]

Here you choose the right operating system and download the certificates.

The official documentation can be found here[https://docs.mitmproxy.org/stable/concepts-certificates/#quick-setup].

=== MitM Proxy ===
When you start the app in Wireshark you can see that the handshake for the DTLS connection is being carried out.

[[File:wireshark-dtls.png]]

You can also observe that there are several connections to different servers outside the network.

[[File:wireshark-tls.png]]

The following messages can be decrypted.

[[File:mitm-sniff.png]]

Both include a JSON-file.

[[File:Json-file-mitm.jpg]]

* In the debug log, you can observe that there are additional TLS connections, but the mitm proxy couldn’t decrypt these.

[[File:Debug-log-mitm.jpg]]

The DTLS connection between the app and the gateway, however, does not appear in the mitm log.

=== Replay-Attack ===
In order to be able to carry out a replay attack, the data traffic between the device on which the IKEA app is running and the IKEA gateway must be recorded. Then the SRC and DST in IP and MAC have to be adjusted accordingly. In this particular example, a sequence number is available in the DTLS protocol. This must also be adjusted so that it is preliminary. Since the payload is also included in the UDP checksum, it must be recalculated too.

[[File:replay-attack.png]]

As you can see, the attack is unsuccessful because no response is sent from the gateway, which is likely to drop the packets.

This may be because DTLS also uses MAC (message authentication code). The sequence number is used to calculate the MAC value. Unfortunately, this value cannot be recalculated without knowing the encryption.

Install c't'-Raspion on Raspberry PI

2020-06-09T08:28:35Z

MMuszik: /* Turning devices on/off */

== Requirements ==
* Raspberry PI with Raspbian OS
* Internet connection

== Description ==

=== Step 1: System Update ===

In the command line interface enter:

sudo apt-get update && sudo apt-get upgrade

=== Step 2: Download ===
Download the latest version of Raspion:

wget ct.de/s/x5Pm -O raspion.zip

=== Step 3: Installation ===
Unzip:
unzip raspion.zip

Install:
cd raspion
./install.sh or bash install.sh

[[File:Install_Raspion.png]]

At the end of the installation there is the wifi name and password of the c't-Raspion.

=== Launch c't-Raspion web interface ===
Atfer connecting to the wifi of the c't'-Raspion go to http://<ip-address of your Raspberry-PI>:81

[[File:Raspion_webinterface.png]]

== Services of the c't-Raspion ==

=== Pi-hole ===
Pi-hole shows DNS-Requests. They can also be blocked.

=== ntopng ===
They include the
involved communication partners, the network protocol and information on duration and volume. ntopng does not show the contents of the packages. But it analyses the flows and provides information about which application is communicating, such as Skype, BitTorrent etc., and provides statistics.

=== Wireshark ===
Wireshark offers a deeper analysis of the network traffic as ntopng. The program allows recording and analyzing network traffic down to the last bit and can be operated via browser as a special feature of c't-Raspion. The recorded network traffic will be saved in pcap-files.

=== mitmproxy ===
The mitm-Proxy can loop into the communication between the local and remote devices by the c't-Raspion redirecting all access from the internal network on TCP ports 80 and 443 to the mitm-Proxy. It takes the redirected accesses to port
8080 towards. The redirection is handled by firewall rules, which can be activated and deactivated as required by clicking in the c't-Raspion web interface.

== Ikea Tradfri Setup Sniff ==
For testing purposes an iphone was cleaned as far as possible. All uninstalable services were erased and synchronization plans were deactivated.
However iphones are not that good for this kind of tests because after all cleaning there were still some connections to apple servers.

To use pihole for capturing the dns queries of the Tradfri Gateway itself you may use an USB networkadapter or an external router as wifi bride. Otherwise you cannot use the Tradfri Gateway due to the lack of connection possibilities. As an workaround outside the Raspion software package classic arpspoofing was used.

Preliminary overview IP addressess:

[[File:ip-config.png|900px]]

Immediately after power on the app is sending dns requests to get ip addresses for fw.ota.homesmart.ikea.net. In the dns answer the ip's to d262cmbxmzphsu.cloudfront.net were included which is an address belonging to amazons aws.

[[File:wireshark-cap1.png|700px]]
[[File:wireshark-cap2.png|700px]]

Also an http get request can be found:
[[File:wireshark-cap-http.png|600px]]

The data from fw.ota.homesmart.ikea.net/feed/version_info.json are not that spectacular. As the name implies it only consists of version information.

As soon as the Ikea Smart Home App starts the setup it tries to find a Tradfri Gateway with mDNS queries.

[[File:wireshark-cap-mDNS.png|550px]]

The mDNS queries are not forwarded through our pihole setup so this technique finding the Tradfri Gateway fails. The app itself provides another way to find the Tradfri Gateway by entering the ip address directly. After submitting the input the app finds the gateway and asks you to scan the QR code on the bottom side of the divce or to enter the security code which can be found near the QR code.

The QR code contains the security code which is used as the pre shared key of the DTLS connection. As soon as the app gets the security code the app and the gateway are initiating the DTLS connection. All applicationdata is send over this encrypted connection.

[[File:wireshark-cap-dtls.png|550px]]

Same implies to connections of additional smart home devices: All data is sent over the encrypted connection.

[[File:wireshark-cap-dtls-snap.png|550px]]

As far as the initial setup goes there are only a few connections to the internet. This connections are all from app to some aws cloud addresses. It seems this is relating to the setup of a new device:

[[File:wireshark-cap-aws.png|550px]]

== Data Transmission when using TRADFRI ==

The IKEA TRADFRI Gateway was connected via LAN cable while the mobile phone running the IKEA app was connected wirelessly to the same network.
Overview of IP addresses used:

[[File:ip_overview_muzik.png|550px]]

Wireshark was used to record the traffic (using arpspoof because the IKEA TRADFRI Gateway requires a LAN connection so it is not possible to just monitor the Raspion WiFi) which was then filtered.

It turns out that TRADFRI is rather well-behaved when it comes to sending data.

For the most part it uses encrypted (DTLS) communication internally between the Gateway and the mobile phone. To initially find the Gateway after opening the mobile app, an MDNS request is sent out via multicast (224.x.x.x).

However, 2 external connections or destinations could also be found:

* IP address 13.227.156.82 / privacypolicy.config.homesmart.ikea.net (as the url indicates, this has the current policy one has to agree to before using the app)
* IP address 13.227.156.50 / supportdetails.config.homesmart.ikea.net (this is where the secure certificates are located, apparently).

=== Wireshark caps ===
privacypolicy.config.homesmart.ikea.net Client Hello:

[[File:Ikea-privacy policy-clientHello.png|700px]]

supportdetails.config.homesmart.ikea.net ServerHello:

[[File:Ikea-supportdetails-serverHello.png|700px]]

=== Certificate Information ===
The Server Hello contains the information regarding the .cer and .crl:
http://ocsp.rootca1.amazontrust.com
http://crt.rootca1.amazontrust.com/rootca1.cer
http://crl.rootca1.amazontrust.com/rootca1.crl
Starfield Technologies, Inc.; Starfield Services Root Certificate Authority

Also:
http://crl.sca1b.amazontrust.com/sca1b.crl
http://ocsp.sca1b.amazontrust.com
http://crt.sca1b.amazontrust.com/sca1b.crt

That's pretty much it. We couldn't find any unwanted connections.

The app also checks for updates for the used devices, this is also indicated in the app when it happens, so this is very transparent. It is indicated in the app when an update is happening or when the app is checking for new updates as can be seen in the screenshot below. If a device happens to be unavailable, e.g. because it is currently disconnected/turned off, then the app does not report back the current version but instead says the device is unreachable ('Nicht erreichbar')

[[File:Ikea-tradfri-update.png|360px]]

=== Turning devices on/off ===
When devices are turned on or off, the individual packet sequences are made up of packets that are the same in size but with some devices there are more packets sent when turning on than off. Let me illustrate this by comparing the on/off sequences of the light bulb (pretty much the same for on/off, although of course different packet content):

Light Bulb ON 
[[File:Ikea-gluehbirne_ein.png|700px]]

Light Bulb OFF 
[[File:Ikea-gluehbirne_aus.png|700px]]

As opposed to the smart plug where the on sequence is 12 packets (versus 8 packets for "off"):

Smart Plug ON 
[[File:Ikea-strom ein.png|700px]]

Smart Plug OFF 
[[File:Ikea-strom aus.png|700px]]

(these were done using arpspoof on 192.168.0.106, 192.168.0.101 is the Internet Gateway, 192.168.0.104 is the TRADFRI Gateway, commands were sent via 192.168.0.103)

== Interrupt Communication ==
This experiment will show if it is possible to interrupt or sniff the communication between the IKEA and the IKEA gateway. This is not possible with only a packet sniffer like Wireshark, because the communication is encrypt with DTLS. Two attacks where performed, a mitm proxy attack and a replay attack. For the mitm attack the mitm proxy from the c’t Raspion was used and for the replay attack a scapy script. The network structure is as follows:

IP overview:

[[File:mitm_findings.png|700px]]

=== Structure ===
[[File:mitm-top.png|800px]]

Android can be operated as a virtual machine, or you can also use a smart phone that has the IKEA Smarthome app installed. If it is operated as a virtual machine, make sure that bridge mode is used, since the VM will then have its own IP. This has the advantage that you only have to analyze the traffic generated by Android and not that of the host system.

In order to be able to use the mitm, certificates must be added to the key store on the android os. This can be done by opening the website mitm.it in the browser of android. If you are in the right network, you will see the following window.

[[File:mitmproxy-cert.png|800px]]

Here you choose the right operating system and download the certificates.

The official documentation can be found here[https://docs.mitmproxy.org/stable/concepts-certificates/#quick-setup].

=== MitM Proxy ===
When you start the app in Wireshark you can see that the handshake for the DTLS connection is being carried out.

[[File:wireshark-dtls.png]]

You can also observe that there are several connections to different servers outside the network.

[[File:wireshark-tls.png]]

The following messages can be decrypted.

[[File:mitm-sniff.png]]

Both include a JSON-file.

[[File:Json-file-mitm.jpg]]

* In the debug log, you can observer that there are additional TLS connections, but the mitm proxy couldn’t decrypt these.

[[File:Debug-log-mitm.jpg]]

The DTLS connection between the app and the gateway, however, does not appear in the mitm log.

=== Replay-Attack ===
In order to be able to carry out a replay attack, the data traffic between the device on which the IKEA app is running and the IKEA gateway must be recorded. Then the SRC and DST in IP and MAC have to be adjusted accordingly. In this particular example, a sequence number is available in the DTLS protocol. This must also be adjusted so that it is preliminary. Since the payload is also included in the UDP checksum, it must be recalculated too.

[[File:replay-attack.png]]

As you can see, the attack is unsuccessful because no response is sent from the gateway, which is likely to drop the packets.

This may be because DTLS also uses MAC (message authentication code). The sequence number is used to calculate the MAC value. Unfortunately, this value cannot be recalculated without knowing the encryption.

File:Ikea-strom aus.png

2020-06-09T08:25:32Z

MMuszik:

Install c't'-Raspion on Raspberry PI

2020-06-09T08:25:10Z

MMuszik: /* Turning devices on/off */

== Requirements ==
* Raspberry PI with Raspbian OS
* Internet connection

== Description ==

=== Step 1: System Update ===

In the command line interface enter:

sudo apt-get update && sudo apt-get upgrade

=== Step 2: Download ===
Download the latest version of Raspion:

wget ct.de/s/x5Pm -O raspion.zip

=== Step 3: Installation ===
Unzip:
unzip raspion.zip

Install:
cd raspion
./install.sh or bash install.sh

[[File:Install_Raspion.png]]

At the end of the installation there is the wifi name and password of the c't-Raspion.

=== Launch c't-Raspion web interface ===
Atfer connecting to the wifi of the c't'-Raspion go to http://<ip-address of your Raspberry-PI>:81

[[File:Raspion_webinterface.png]]

== Services of the c't-Raspion ==

=== Pi-hole ===
Pi-hole shows DNS-Requests. They can also be blocked.

=== ntopng ===
They include the
involved communication partners, the network protocol and information on duration and volume. ntopng does not show the contents of the packages. But it analyses the flows and provides information about which application is communicating, such as Skype, BitTorrent etc., and provides statistics.

=== Wireshark ===
Wireshark offers a deeper analysis of the network traffic as ntopng. The program allows recording and analyzing network traffic down to the last bit and can be operated via browser as a special feature of c't-Raspion. The recorded network traffic will be saved in pcap-files.

=== mitmproxy ===
The mitm-Proxy can loop into the communication between the local and remote devices by the c't-Raspion redirecting all access from the internal network on TCP ports 80 and 443 to the mitm-Proxy. It takes the redirected accesses to port
8080 towards. The redirection is handled by firewall rules, which can be activated and deactivated as required by clicking in the c't-Raspion web interface.

== Ikea Tradfri Setup Sniff ==
For testing purposes an iphone was cleaned as far as possible. All uninstalable services were erased and synchronization plans were deactivated.
However iphones are not that good for this kind of tests because after all cleaning there were still some connections to apple servers.

To use pihole for capturing the dns queries of the Tradfri Gateway itself you may use an USB networkadapter or an external router as wifi bride. Otherwise you cannot use the Tradfri Gateway due to the lack of connection possibilities. As an workaround outside the Raspion software package classic arpspoofing was used.

Preliminary overview IP addressess:

[[File:ip-config.png|900px]]

Immediately after power on the app is sending dns requests to get ip addresses for fw.ota.homesmart.ikea.net. In the dns answer the ip's to d262cmbxmzphsu.cloudfront.net were included which is an address belonging to amazons aws.

[[File:wireshark-cap1.png|700px]]
[[File:wireshark-cap2.png|700px]]

Also an http get request can be found:
[[File:wireshark-cap-http.png|600px]]

The data from fw.ota.homesmart.ikea.net/feed/version_info.json are not that spectacular. As the name implies it only consists of version information.

As soon as the Ikea Smart Home App starts the setup it tries to find a Tradfri Gateway with mDNS queries.

[[File:wireshark-cap-mDNS.png|550px]]

The mDNS queries are not forwarded through our pihole setup so this technique finding the Tradfri Gateway fails. The app itself provides another way to find the Tradfri Gateway by entering the ip address directly. After submitting the input the app finds the gateway and asks you to scan the QR code on the bottom side of the divce or to enter the security code which can be found near the QR code.

The QR code contains the security code which is used as the pre shared key of the DTLS connection. As soon as the app gets the security code the app and the gateway are initiating the DTLS connection. All applicationdata is send over this encrypted connection.

[[File:wireshark-cap-dtls.png|550px]]

Same implies to connections of additional smart home devices: All data is sent over the encrypted connection.

[[File:wireshark-cap-dtls-snap.png|550px]]

As far as the initial setup goes there are only a few connections to the internet. This connections are all from app to some aws cloud addresses. It seems this is relating to the setup of a new device:

[[File:wireshark-cap-aws.png|550px]]

== Data Transmission when using TRADFRI ==

The IKEA TRADFRI Gateway was connected via LAN cable while the mobile phone running the IKEA app was connected wirelessly to the same network.
Overview of IP addresses used:

[[File:ip_overview_muzik.png|550px]]

Wireshark was used to record the traffic (using arpspoof because the IKEA TRADFRI Gateway requires a LAN connection so it is not possible to just monitor the Raspion WiFi) which was then filtered.

It turns out that TRADFRI is rather well-behaved when it comes to sending data.

For the most part it uses encrypted (DTLS) communication internally between the Gateway and the mobile phone. To initially find the Gateway after opening the mobile app, an MDNS request is sent out via multicast (224.x.x.x).

However, 2 external connections or destinations could also be found:

* IP address 13.227.156.82 / privacypolicy.config.homesmart.ikea.net (as the url indicates, this has the current policy one has to agree to before using the app)
* IP address 13.227.156.50 / supportdetails.config.homesmart.ikea.net (this is where the secure certificates are located, apparently).

=== Wireshark caps ===
privacypolicy.config.homesmart.ikea.net Client Hello:

[[File:Ikea-privacy policy-clientHello.png|700px]]

supportdetails.config.homesmart.ikea.net ServerHello:

[[File:Ikea-supportdetails-serverHello.png|700px]]

=== Certificate Information ===
The Server Hello contains the information regarding the .cer and .crl:
http://ocsp.rootca1.amazontrust.com
http://crt.rootca1.amazontrust.com/rootca1.cer
http://crl.rootca1.amazontrust.com/rootca1.crl
Starfield Technologies, Inc.; Starfield Services Root Certificate Authority

Also:
http://crl.sca1b.amazontrust.com/sca1b.crl
http://ocsp.sca1b.amazontrust.com
http://crt.sca1b.amazontrust.com/sca1b.crt

That's pretty much it. We couldn't find any unwanted connections.

The app also checks for updates for the used devices, this is also indicated in the app when it happens, so this is very transparent. It is indicated in the app when an update is happening or when the app is checking for new updates as can be seen in the screenshot below. If a device happens to be unavailable, e.g. because it is currently disconnected/turned off, then the app does not report back the current version but instead says the device is unreachable ('Nicht erreichbar')

[[File:Ikea-tradfri-update.png|360px]]

=== Turning devices on/off ===
When devices are turned on or off, the individual packet sequences are made up of packets that are the same in size but with some devices there are more packets sent when turning on than off. Let me illustrate this by comparing the on/off sequences of the light bulb (pretty much the same for on/off, although of course different packet content):

Light Bulb ON
[[File:Ikea-gluehbirne_ein.png|700px]]

Light Bulb OFF
[[File:Ikea-gluehbirne_aus.png|700px]]

As opposed to the smart plug where the on sequence is 12 packets (versus 8 packets for "off"):

Smart Plug ON
[[File:Ikea-strom ein.png|700px]]

Smart Plug OFF
[[File:Ikea-strom aus.png|700px]]

== Interrupt Communication ==
This experiment will show if it is possible to interrupt or sniff the communication between the IKEA and the IKEA gateway. This is not possible with only a packet sniffer like Wireshark, because the communication is encrypt with DTLS. Two attacks where performed, a mitm proxy attack and a replay attack. For the mitm attack the mitm proxy from the c’t Raspion was used and for the replay attack a scapy script. The network structure is as follows:

IP overview:

[[File:mitm_findings.png|700px]]

=== Structure ===
[[File:mitm-top.png|800px]]

Android can be operated as a virtual machine, or you can also use a smart phone that has the IKEA Smarthome app installed. If it is operated as a virtual machine, make sure that bridge mode is used, since the VM will then have its own IP. This has the advantage that you only have to analyze the traffic generated by Android and not that of the host system.

In order to be able to use the mitm, certificates must be added to the key store on the android os. This can be done by opening the website mitm.it in the browser of android. If you are in the right network, you will see the following window.

[[File:mitmproxy-cert.png|800px]]

Here you choose the right operating system and download the certificates.

The official documentation can be found here[https://docs.mitmproxy.org/stable/concepts-certificates/#quick-setup].

=== MitM Proxy ===
When you start the app in Wireshark you can see that the handshake for the DTLS connection is being carried out.

[[File:wireshark-dtls.png]]

You can also observe that there are several connections to different servers outside the network.

[[File:wireshark-tls.png]]

The following messages can be decrypted.

[[File:mitm-sniff.png]]

Both include a JSON-file.

[[File:Json-file-mitm.jpg]]

* In the debug log, you can observer that there are additional TLS connections, but the mitm proxy couldn’t decrypt these.

[[File:Debug-log-mitm.jpg]]

The DTLS connection between the app and the gateway, however, does not appear in the mitm log.

=== Replay-Attack ===
In order to be able to carry out a replay attack, the data traffic between the device on which the IKEA app is running and the IKEA gateway must be recorded. Then the SRC and DST in IP and MAC have to be adjusted accordingly. In this particular example, a sequence number is available in the DTLS protocol. This must also be adjusted so that it is preliminary. Since the payload is also included in the UDP checksum, it must be recalculated too.

[[File:replay-attack.png]]

As you can see, the attack is unsuccessful because no response is sent from the gateway, which is likely to drop the packets.

This may be because DTLS also uses MAC (message authentication code). The sequence number is used to calculate the MAC value. Unfortunately, this value cannot be recalculated without knowing the encryption.

File:Ikea-strom ein.png

2020-06-09T08:24:29Z

MMuszik:

Install c't'-Raspion on Raspberry PI

2020-06-09T08:23:37Z

MMuszik: /* Turning devices on/off */

== Requirements ==
* Raspberry PI with Raspbian OS
* Internet connection

== Description ==

=== Step 1: System Update ===

In the command line interface enter:

sudo apt-get update && sudo apt-get upgrade

=== Step 2: Download ===
Download the latest version of Raspion:

wget ct.de/s/x5Pm -O raspion.zip

=== Step 3: Installation ===
Unzip:
unzip raspion.zip

Install:
cd raspion
./install.sh or bash install.sh

[[File:Install_Raspion.png]]

At the end of the installation there is the wifi name and password of the c't-Raspion.

=== Launch c't-Raspion web interface ===
Atfer connecting to the wifi of the c't'-Raspion go to http://<ip-address of your Raspberry-PI>:81

[[File:Raspion_webinterface.png]]

== Services of the c't-Raspion ==

=== Pi-hole ===
Pi-hole shows DNS-Requests. They can also be blocked.

=== ntopng ===
They include the
involved communication partners, the network protocol and information on duration and volume. ntopng does not show the contents of the packages. But it analyses the flows and provides information about which application is communicating, such as Skype, BitTorrent etc., and provides statistics.

=== Wireshark ===
Wireshark offers a deeper analysis of the network traffic as ntopng. The program allows recording and analyzing network traffic down to the last bit and can be operated via browser as a special feature of c't-Raspion. The recorded network traffic will be saved in pcap-files.

=== mitmproxy ===
The mitm-Proxy can loop into the communication between the local and remote devices by the c't-Raspion redirecting all access from the internal network on TCP ports 80 and 443 to the mitm-Proxy. It takes the redirected accesses to port
8080 towards. The redirection is handled by firewall rules, which can be activated and deactivated as required by clicking in the c't-Raspion web interface.

== Ikea Tradfri Setup Sniff ==
For testing purposes an iphone was cleaned as far as possible. All uninstalable services were erased and synchronization plans were deactivated.
However iphones are not that good for this kind of tests because after all cleaning there were still some connections to apple servers.

To use pihole for capturing the dns queries of the Tradfri Gateway itself you may use an USB networkadapter or an external router as wifi bride. Otherwise you cannot use the Tradfri Gateway due to the lack of connection possibilities. As an workaround outside the Raspion software package classic arpspoofing was used.

Preliminary overview IP addressess:

[[File:ip-config.png|900px]]

Immediately after power on the app is sending dns requests to get ip addresses for fw.ota.homesmart.ikea.net. In the dns answer the ip's to d262cmbxmzphsu.cloudfront.net were included which is an address belonging to amazons aws.

[[File:wireshark-cap1.png|700px]]
[[File:wireshark-cap2.png|700px]]

Also an http get request can be found:
[[File:wireshark-cap-http.png|600px]]

The data from fw.ota.homesmart.ikea.net/feed/version_info.json are not that spectacular. As the name implies it only consists of version information.

As soon as the Ikea Smart Home App starts the setup it tries to find a Tradfri Gateway with mDNS queries.

[[File:wireshark-cap-mDNS.png|550px]]

The mDNS queries are not forwarded through our pihole setup so this technique finding the Tradfri Gateway fails. The app itself provides another way to find the Tradfri Gateway by entering the ip address directly. After submitting the input the app finds the gateway and asks you to scan the QR code on the bottom side of the divce or to enter the security code which can be found near the QR code.

The QR code contains the security code which is used as the pre shared key of the DTLS connection. As soon as the app gets the security code the app and the gateway are initiating the DTLS connection. All applicationdata is send over this encrypted connection.

[[File:wireshark-cap-dtls.png|550px]]

Same implies to connections of additional smart home devices: All data is sent over the encrypted connection.

[[File:wireshark-cap-dtls-snap.png|550px]]

As far as the initial setup goes there are only a few connections to the internet. This connections are all from app to some aws cloud addresses. It seems this is relating to the setup of a new device:

[[File:wireshark-cap-aws.png|550px]]

== Data Transmission when using TRADFRI ==

The IKEA TRADFRI Gateway was connected via LAN cable while the mobile phone running the IKEA app was connected wirelessly to the same network.
Overview of IP addresses used:

[[File:ip_overview_muzik.png|550px]]

Wireshark was used to record the traffic (using arpspoof because the IKEA TRADFRI Gateway requires a LAN connection so it is not possible to just monitor the Raspion WiFi) which was then filtered.

It turns out that TRADFRI is rather well-behaved when it comes to sending data.

For the most part it uses encrypted (DTLS) communication internally between the Gateway and the mobile phone. To initially find the Gateway after opening the mobile app, an MDNS request is sent out via multicast (224.x.x.x).

However, 2 external connections or destinations could also be found:

* IP address 13.227.156.82 / privacypolicy.config.homesmart.ikea.net (as the url indicates, this has the current policy one has to agree to before using the app)
* IP address 13.227.156.50 / supportdetails.config.homesmart.ikea.net (this is where the secure certificates are located, apparently).

=== Wireshark caps ===
privacypolicy.config.homesmart.ikea.net Client Hello:

[[File:Ikea-privacy policy-clientHello.png|700px]]

supportdetails.config.homesmart.ikea.net ServerHello:

[[File:Ikea-supportdetails-serverHello.png|700px]]

=== Certificate Information ===
The Server Hello contains the information regarding the .cer and .crl:
http://ocsp.rootca1.amazontrust.com
http://crt.rootca1.amazontrust.com/rootca1.cer
http://crl.rootca1.amazontrust.com/rootca1.crl
Starfield Technologies, Inc.; Starfield Services Root Certificate Authority

Also:
http://crl.sca1b.amazontrust.com/sca1b.crl
http://ocsp.sca1b.amazontrust.com
http://crt.sca1b.amazontrust.com/sca1b.crt

That's pretty much it. We couldn't find any unwanted connections.

The app also checks for updates for the used devices, this is also indicated in the app when it happens, so this is very transparent. It is indicated in the app when an update is happening or when the app is checking for new updates as can be seen in the screenshot below. If a device happens to be unavailable, e.g. because it is currently disconnected/turned off, then the app does not report back the current version but instead says the device is unreachable ('Nicht erreichbar')

[[File:Ikea-tradfri-update.png|360px]]

=== Turning devices on/off ===
When devices are turned on or off, the individual packet sequences are made up of packets that are the same in size but with some devices there are more packets sent when turning on than off. Let me illustrate this by comparing the on/off sequences of the light bulb (pretty much the same for on/off, although of course different packet content):

[[File:Ikea-gluehbirne_ein.png|700px]]

[[File:Ikea-gluehbirne_aus.png|700px]]

As opposed to the smart plug where the on sequence is 12 packets (versus 8 packets for "off"):

== Interrupt Communication ==
This experiment will show if it is possible to interrupt or sniff the communication between the IKEA and the IKEA gateway. This is not possible with only a packet sniffer like Wireshark, because the communication is encrypt with DTLS. Two attacks where performed, a mitm proxy attack and a replay attack. For the mitm attack the mitm proxy from the c’t Raspion was used and for the replay attack a scapy script. The network structure is as follows:

IP overview:

[[File:mitm_findings.png|700px]]

=== Structure ===
[[File:mitm-top.png|800px]]

Android can be operated as a virtual machine, or you can also use a smart phone that has the IKEA Smarthome app installed. If it is operated as a virtual machine, make sure that bridge mode is used, since the VM will then have its own IP. This has the advantage that you only have to analyze the traffic generated by Android and not that of the host system.

In order to be able to use the mitm, certificates must be added to the key store on the android os. This can be done by opening the website mitm.it in the browser of android. If you are in the right network, you will see the following window.

[[File:mitmproxy-cert.png|800px]]

Here you choose the right operating system and download the certificates.

The official documentation can be found here[https://docs.mitmproxy.org/stable/concepts-certificates/#quick-setup].

=== MitM Proxy ===
When you start the app in Wireshark you can see that the handshake for the DTLS connection is being carried out.

[[File:wireshark-dtls.png]]

You can also observe that there are several connections to different servers outside the network.

[[File:wireshark-tls.png]]

The following messages can be decrypted.

[[File:mitm-sniff.png]]

Both include a JSON-file.

[[File:Json-file-mitm.jpg]]

* In the debug log, you can observer that there are additional TLS connections, but the mitm proxy couldn’t decrypt these.

[[File:Debug-log-mitm.jpg]]

The DTLS connection between the app and the gateway, however, does not appear in the mitm log.

=== Replay-Attack ===
In order to be able to carry out a replay attack, the data traffic between the device on which the IKEA app is running and the IKEA gateway must be recorded. Then the SRC and DST in IP and MAC have to be adjusted accordingly. In this particular example, a sequence number is available in the DTLS protocol. This must also be adjusted so that it is preliminary. Since the payload is also included in the UDP checksum, it must be recalculated too.

[[File:replay-attack.png]]

As you can see, the attack is unsuccessful because no response is sent from the gateway, which is likely to drop the packets.

This may be because DTLS also uses MAC (message authentication code). The sequence number is used to calculate the MAC value. Unfortunately, this value cannot be recalculated without knowing the encryption.

Install c't'-Raspion on Raspberry PI

2020-06-09T08:23:14Z

MMuszik: /* Data Transmission when using TRADFRI */

== Requirements ==
* Raspberry PI with Raspbian OS
* Internet connection

== Description ==

=== Step 1: System Update ===

In the command line interface enter:

sudo apt-get update && sudo apt-get upgrade

=== Step 2: Download ===
Download the latest version of Raspion:

wget ct.de/s/x5Pm -O raspion.zip

=== Step 3: Installation ===
Unzip:
unzip raspion.zip

Install:
cd raspion
./install.sh or bash install.sh

[[File:Install_Raspion.png]]

At the end of the installation there is the wifi name and password of the c't-Raspion.

=== Launch c't-Raspion web interface ===
Atfer connecting to the wifi of the c't'-Raspion go to http://<ip-address of your Raspberry-PI>:81

[[File:Raspion_webinterface.png]]

== Services of the c't-Raspion ==

=== Pi-hole ===
Pi-hole shows DNS-Requests. They can also be blocked.

=== ntopng ===
They include the
involved communication partners, the network protocol and information on duration and volume. ntopng does not show the contents of the packages. But it analyses the flows and provides information about which application is communicating, such as Skype, BitTorrent etc., and provides statistics.

=== Wireshark ===
Wireshark offers a deeper analysis of the network traffic as ntopng. The program allows recording and analyzing network traffic down to the last bit and can be operated via browser as a special feature of c't-Raspion. The recorded network traffic will be saved in pcap-files.

=== mitmproxy ===
The mitm-Proxy can loop into the communication between the local and remote devices by the c't-Raspion redirecting all access from the internal network on TCP ports 80 and 443 to the mitm-Proxy. It takes the redirected accesses to port
8080 towards. The redirection is handled by firewall rules, which can be activated and deactivated as required by clicking in the c't-Raspion web interface.

== Ikea Tradfri Setup Sniff ==
For testing purposes an iphone was cleaned as far as possible. All uninstalable services were erased and synchronization plans were deactivated.
However iphones are not that good for this kind of tests because after all cleaning there were still some connections to apple servers.

To use pihole for capturing the dns queries of the Tradfri Gateway itself you may use an USB networkadapter or an external router as wifi bride. Otherwise you cannot use the Tradfri Gateway due to the lack of connection possibilities. As an workaround outside the Raspion software package classic arpspoofing was used.

Preliminary overview IP addressess:

[[File:ip-config.png|900px]]

Immediately after power on the app is sending dns requests to get ip addresses for fw.ota.homesmart.ikea.net. In the dns answer the ip's to d262cmbxmzphsu.cloudfront.net were included which is an address belonging to amazons aws.

[[File:wireshark-cap1.png|700px]]
[[File:wireshark-cap2.png|700px]]

Also an http get request can be found:
[[File:wireshark-cap-http.png|600px]]

The data from fw.ota.homesmart.ikea.net/feed/version_info.json are not that spectacular. As the name implies it only consists of version information.

As soon as the Ikea Smart Home App starts the setup it tries to find a Tradfri Gateway with mDNS queries.

[[File:wireshark-cap-mDNS.png|550px]]

The mDNS queries are not forwarded through our pihole setup so this technique finding the Tradfri Gateway fails. The app itself provides another way to find the Tradfri Gateway by entering the ip address directly. After submitting the input the app finds the gateway and asks you to scan the QR code on the bottom side of the divce or to enter the security code which can be found near the QR code.

The QR code contains the security code which is used as the pre shared key of the DTLS connection. As soon as the app gets the security code the app and the gateway are initiating the DTLS connection. All applicationdata is send over this encrypted connection.

[[File:wireshark-cap-dtls.png|550px]]

Same implies to connections of additional smart home devices: All data is sent over the encrypted connection.

[[File:wireshark-cap-dtls-snap.png|550px]]

As far as the initial setup goes there are only a few connections to the internet. This connections are all from app to some aws cloud addresses. It seems this is relating to the setup of a new device:

[[File:wireshark-cap-aws.png|550px]]

== Data Transmission when using TRADFRI ==

The IKEA TRADFRI Gateway was connected via LAN cable while the mobile phone running the IKEA app was connected wirelessly to the same network.
Overview of IP addresses used:

[[File:ip_overview_muzik.png|550px]]

Wireshark was used to record the traffic (using arpspoof because the IKEA TRADFRI Gateway requires a LAN connection so it is not possible to just monitor the Raspion WiFi) which was then filtered.

It turns out that TRADFRI is rather well-behaved when it comes to sending data.

For the most part it uses encrypted (DTLS) communication internally between the Gateway and the mobile phone. To initially find the Gateway after opening the mobile app, an MDNS request is sent out via multicast (224.x.x.x).

However, 2 external connections or destinations could also be found:

* IP address 13.227.156.82 / privacypolicy.config.homesmart.ikea.net (as the url indicates, this has the current policy one has to agree to before using the app)
* IP address 13.227.156.50 / supportdetails.config.homesmart.ikea.net (this is where the secure certificates are located, apparently).

=== Wireshark caps ===
privacypolicy.config.homesmart.ikea.net Client Hello:

[[File:Ikea-privacy policy-clientHello.png|700px]]

supportdetails.config.homesmart.ikea.net ServerHello:

[[File:Ikea-supportdetails-serverHello.png|700px]]

=== Certificate Information ===
The Server Hello contains the information regarding the .cer and .crl:
http://ocsp.rootca1.amazontrust.com
http://crt.rootca1.amazontrust.com/rootca1.cer
http://crl.rootca1.amazontrust.com/rootca1.crl
Starfield Technologies, Inc.; Starfield Services Root Certificate Authority

Also:
http://crl.sca1b.amazontrust.com/sca1b.crl
http://ocsp.sca1b.amazontrust.com
http://crt.sca1b.amazontrust.com/sca1b.crt

That's pretty much it. We couldn't find any unwanted connections.

The app also checks for updates for the used devices, this is also indicated in the app when it happens, so this is very transparent. It is indicated in the app when an update is happening or when the app is checking for new updates as can be seen in the screenshot below. If a device happens to be unavailable, e.g. because it is currently disconnected/turned off, then the app does not report back the current version but instead says the device is unreachable ('Nicht erreichbar')

[[File:Ikea-tradfri-update.png|360px]]

=== Turning devices on/off ===
When devices are turned on or off, the individual packet sequences are made up of packets that are the same in size but with some devices there are more packets sent when turning on than off. Let me illustrate this by comparing the on/off sequences of the light bulb (pretty much the same for on/off, although of course different packet content):

[[File:File:Ikea-gluehbirne_ein.png|700px]]
[[File:File:Ikea-gluehbirne_aus.png|700px]]

As opposed to the smart plug where the on sequence is 12 packets (versus 8 packets for "off"):

== Interrupt Communication ==
This experiment will show if it is possible to interrupt or sniff the communication between the IKEA and the IKEA gateway. This is not possible with only a packet sniffer like Wireshark, because the communication is encrypt with DTLS. Two attacks where performed, a mitm proxy attack and a replay attack. For the mitm attack the mitm proxy from the c’t Raspion was used and for the replay attack a scapy script. The network structure is as follows:

IP overview:

[[File:mitm_findings.png|700px]]

=== Structure ===
[[File:mitm-top.png|800px]]

Android can be operated as a virtual machine, or you can also use a smart phone that has the IKEA Smarthome app installed. If it is operated as a virtual machine, make sure that bridge mode is used, since the VM will then have its own IP. This has the advantage that you only have to analyze the traffic generated by Android and not that of the host system.

In order to be able to use the mitm, certificates must be added to the key store on the android os. This can be done by opening the website mitm.it in the browser of android. If you are in the right network, you will see the following window.

[[File:mitmproxy-cert.png|800px]]

Here you choose the right operating system and download the certificates.

The official documentation can be found here[https://docs.mitmproxy.org/stable/concepts-certificates/#quick-setup].

=== MitM Proxy ===
When you start the app in Wireshark you can see that the handshake for the DTLS connection is being carried out.

[[File:wireshark-dtls.png]]

You can also observe that there are several connections to different servers outside the network.

[[File:wireshark-tls.png]]

The following messages can be decrypted.

[[File:mitm-sniff.png]]

Both include a JSON-file.

[[File:Json-file-mitm.jpg]]

* In the debug log, you can observer that there are additional TLS connections, but the mitm proxy couldn’t decrypt these.

[[File:Debug-log-mitm.jpg]]

The DTLS connection between the app and the gateway, however, does not appear in the mitm log.

=== Replay-Attack ===
In order to be able to carry out a replay attack, the data traffic between the device on which the IKEA app is running and the IKEA gateway must be recorded. Then the SRC and DST in IP and MAC have to be adjusted accordingly. In this particular example, a sequence number is available in the DTLS protocol. This must also be adjusted so that it is preliminary. Since the payload is also included in the UDP checksum, it must be recalculated too.

[[File:replay-attack.png]]

As you can see, the attack is unsuccessful because no response is sent from the gateway, which is likely to drop the packets.

This may be because DTLS also uses MAC (message authentication code). The sequence number is used to calculate the MAC value. Unfortunately, this value cannot be recalculated without knowing the encryption.

File:Ikea-gluehbirne aus.png

2020-06-09T08:21:16Z

MMuszik:

File:Ikea-gluehbirne ein.png

2020-06-09T08:20:09Z

MMuszik:

Install c't'-Raspion on Raspberry PI

2020-05-11T16:57:37Z

MMuszik:

== Requirements ==
* Raspberry PI with Raspbian OS
* Internet connection

== Description ==

=== Step 1: System Update ===

In the command line interface enter:

sudo apt-get update && sudo apt-get upgrade

=== Step 2: Download ===
Download the latest version of Raspion:

wget ct.de/s/x5Pm -O raspion.zip

=== Step 3: Installation ===
Unzip:
unzip raspion.zip

Install:
cd raspion
./install.sh or bash install.sh

[[File:Install_Raspion.png]]

At the end of the installation there is the wifi name and password of the c't-Raspion.

=== Launch c't-Raspion web interface ===
Atfer connecting to the wifi of the c't'-Raspion go to http://<ip-address of your Raspberry-PI>:81

[[File:Raspion_webinterface.png]]

== Services of the c't-Raspion ==

=== Pi-hole ===
Pi-hole shows DNS-Requests. They can also be blocked.

[[File:pi-hole.png]]

=== ntopng ===
They include the
involved communication partners, the network protocol and information on duration and volume. ntopng does not show the contents of the packages. But it analyses the flows and provides information about which application is communicating, such as Skype, BitTorrent etc., and provides statistics.

=== Wireshark ===
Wireshark offers a deeper analysis of the network traffic as ntopng. The program allows recording and analyzing network traffic down to the last bit and can be operated via browser as a special feature of c't-Raspion. The recorded network traffic will be saved in pcap-files.

=== mitmproxy ===
The mitm-Proxy can loop into the communication between the local and remote devices by the c't-Raspion redirecting all access from the internal network on TCP ports 80 and 443 to the mitm-Proxy. It takes the redirected accesses to port
8080 towards. The redirection is handled by firewall rules, which can be activated and deactivated as required by clicking in the c't-Raspion web interface.

== Ikea Tradfri Setup Sniff ==
Als Testgerät wurde ein möglich leergeräumtes iPhone verwendet. Alle deinstallierbaren Services wurden entfernt, wo möglich Synchronisierung deaktiviert.
Jedoch sind Apple geräte mäßig geeignet, es werden zu viele Verbindungen vom Betriebssystem hergestellt (auch von deaktivierten iOs Services).

Um Pihole auch zur Aufzeichnung von DNS queries vom Tradfri Gateway zu nutzen muss eine USB Netzwerkadapter verwendet werden oder ein externer Router als WiFi Bridge konfiguriert werden. Ohne diese Hardwareänderungen lässt sich ein Tradfri Gateway nicht in das Raspion Netzwerk integrieren. Um dennoch Pakete mitschneiden zu können wurde arpspoofing verwendet.

Vorab Übersicht IP config

[[File:ip-config.png|800px]]

Direkt beim Einschalten (cap power_on_gateway) werden von der App einige DNS anfragen gestellt um IPs von fw.ota.homesmart.ikea.net zu erhalten. In den DNS Antworten sind ebenfalls IPs zu d262cmbxmzphsu.cloudfront.net enthalten. Ikea nutzt dabei AWS.

[[File:wireshark-cap1.png|700px]]
[[File:wireshark-cap2.png|700px]]

Weiters findet man eine http Verbindung:

[[File:wireshark-cap-http.png|600px]]

Die unter fw.ota.homesmart.ikea.net/feed/version_info.json vorhandenen Daten sind nicht allzu spektakulär: Es sind lediglich Versionsinfos.

Sobald über die Ikea Smart Home App das Setup gestarted wird versucht die App mit mDNS queries den Tradfri Gateway zu finden.

[[File:wireshark-cap-mDNS.png|550px]]

Bei dem verwendeten Setup schlägt dies natürlich fehl, jedoch bietet die App direkt die option eine IP manuell einzugeben. Nach Eingabe der IP muss entweder der QR Code auf der Rückseite des Gerätes gescannt werden oder der Sicherheitscode eingegeben werden der sich ebenfalls auf der Rückseite des Geräts befindet.

Der Sicherheitscode ist dabei der PSK der DTLS Verbindung. Sobald der App der QR Code bzw der Sicherheitscode bekannt sind bauen App und Gateway eine DTLS Verbindung auf. Über diese Verbindung werden alle Applikationsdaten gesendet.

[[File:wireshark-cap-dtls.png|550px]]

Auch beim Verbinden von weiteren SH Geräten baut die App keine gesonderten Verbindung auf sondern kommuniziert ausschließlich über DTLS.

[[File:wireshark-cap-dtls-snap.png|550px]]

Einige Verbindungen zur AWS Cloud baut die App dennoch auf. Dies steht anscheinend im Zusammenhang mit dem Verbinden von Geräten da immer direkt nach dem Verbinden eines Gerätes diese Seiten abgefragt werden:

[[File:wireshark-cap-aws.png|550px]]

== Data Transmission when using TRADFRI ==

The IKEA TRADFRI Gateway was connected via LAN cable while the mobile phone running the IKEA app was connected wirelessly to the same network.

Wireshark was used to record the traffic (using arpspoof because the IKEA TRADFRI Gateway requires a LAN connection so it is not possible to just monitor the Raspion WiFi) which was then filtered.

It turns out that TRADFRI is rather well-behaved when it comes to sending data.

For the most part it uses encrypted (DTLS) communication internally between the Gateway and the mobile phone. To initially find the Gateway after opening the mobile app, an MDNS request is sent out via multicast (224.x.x.x).

However, 2 external connections or destinations could also be found:

* IP address 13.227.156.82 / privacypolicy.config.homesmart.ikea.net (as the url indicates, this has the current policy one has to agree to before using the app)
* IP address 13.227.156.50 / supportdetails.config.homesmart.ikea.net (this is where the secure certificates are located, apparently).

=== Wireshark caps ===
privacypolicy.config.homesmart.ikea.net Client Hello:

[[File:Ikea-privacy policy-clientHello.png|700px]]

supportdetails.config.homesmart.ikea.net ServerHello:

[[File:Ikea-supportdetails-serverHello.png|700px]]

=== Certificate Information ===
The Server Hello contains the information regarding the .cer and .crl:
http://ocsp.rootca1.amazontrust.com
http://crt.rootca1.amazontrust.com/rootca1.cer
http://crl.rootca1.amazontrust.com/rootca1.crl
Starfield Technologies, Inc.; Starfield Services Root Certificate Authority

Also:
http://crl.sca1b.amazontrust.com/sca1b.crl
http://ocsp.sca1b.amazontrust.com
http://crt.sca1b.amazontrust.com/sca1b.crt

That's pretty much it. We couldn't find any unwanted connections.

The app also checks for updates for the used devices, this is also indicated in the app when it happens, so this is very transparent. It is indicated in the app when an update is happening or when the app is checking for new updates as can be seen in the screenshot below. If a device happens to be unavailable, e.g. because it is currently disconnected/turned off, then the app does not report back the current version but instead says the device is unreachable ('Nicht erreichbar')

[[File:Ikea-tradfri-update.png|360px]]

== Kommunikation entschlüsseln ==
Bei diesem Versuch wird geschaut ob es möglich ist die Kommunikation, zwischen der IKEA App und dem IKEA Gateway mitzuhören. Nur mit einem Packet Sniffer ist dies nicht möglich, da die Kommunikation per DTLS verschlüsselt wird. Es kam zum Einsatz der MITM Proxy, welcher bei dem c’t-Raspion dabei ist.

=== Aufbau ===
[[File:mitm-top.png|800px]]

Android kann als eine Virtuelle Maschine betrieben werden, oder es kann auch ein Smart Phone benutzt werden welches die IKEA Smarthome App installiert hat. Wenn es als Virtuelle Maschine betrieben wird, ist drauf zu achten, dass der Bridge Mode benutzt wird, da dann die VM eine eigene IP erhält. Dies hat den Vorteil, dass man nur den Traffic analysieren muss, welcher von Android erzeugt wird und nicht dem des Host Systems.
Um den MITM benutzten zu können, müssen die Zertifikaten zu dem Key-Store hinzugefügt werden. Dies kann getan werden in dem man die Website mitm.it ansurft. Ist man in dem richtigen Netzwerk sieht man folgendes Fenster.

[[File:mitmproxy-cert.png|800px]]

Hier wählt man das richtige Betriebssystem und lädt die Zertifikate herunter.

Die offizielle Dokumentation findet man hier[https://docs.mitmproxy.org/stable/concepts-certificates/#quick-setup].

=== Findings ===
Beim Starten der App kann man in Wireshark stehen, dass der Handshake für die DTLS Verbindung durchgeführt wird.

[[File:wireshark-dtls.png]]

Ebenso kann man beobachten, dass mehrere Verbindungen mit verschiedenen Servern nach draußen aufgebaut werden.

[[File:wireshark-tls.png]]

Die Nachrichten zu diesen Servern können durch den MITM entschlüsselt werden.

[[File:mitm-sniff.png]]

Beide Nachrichten beinhalten eine JSON-Datei.

{
"descriptionText": "That’s why we have updated the terms and conditions. Please agree below in order to continue. You can find the updated legal information in Settings or you can read more below.",
"lastUpdatedTimestampCookie": 1568799375000,
"lastUpdatedTimestampPP": 1568798738000,
"lastUpdatedTimestampTnC": 1568798786000,
"titleText": "We’ve changed the name of our app! "
}
{
"versionCode": "44",
"versionName": "1.11.3"
}

Im debug log kann beobachtet werden, dass weitere TLS Verbindung aufgebaut werden jedoch nicht entschlüsselt werden können.

192.168.24.241:59332: Client Handshake failed. The client may not trust the proxy's certificate for data.logentries.com.
192.168.24.241:59332: ClientHandshakeException('Cannot establish TLS with client (sni: data.logentries.com): TlsException("(-1, \'Unexpected EOF\')")')
::ffff:192.168.24.241:58971: serverdisconnect
-> ('99.86.243.4', 443)
192.168.24.241:59332: clientdisconnect
::ffff:192.168.24.241:40204: serverdisconnect
-> ('99.86.243.50', 443)
192.168.24.241:58971: clientdisconnect
192.168.24.241:40204: clientdisconnect
192.168.24.241:41657: clientconnect
::ffff:192.168.24.241:41657: Establish TLS with client
192.168.24.241:50453: clientconnect
::ffff:192.168.24.241:50453: serverconnect
-> ('99.86.243.36', 443)
192.168.24.241:42222: clientconnect
::ffff:192.168.24.241:42222: serverconnect
-> ('99.86.243.4', 443)
::ffff:192.168.24.241:42222: Establish TLS with server
::ffff:192.168.24.241:50453: Establish TLS with server
::ffff:192.168.24.241:42222: ALPN selected by server: -
::ffff:192.168.24.241:42222: Establish TLS with client
::ffff:192.168.24.241:50453: ALPN selected by server: -
::ffff:192.168.24.241:50453: Establish TLS with client
::ffff:192.168.24.241:42222: ALPN for client: b'http/1.1'
::ffff:192.168.24.241:50453: ALPN for client: b'http/1.1'
::ffff:192.168.24.241:50453: request
-> Request(GET /US/en/getPolicyUpdate/?deviceType=android)
::ffff:192.168.24.241:42222: request
-> Request(GET /AppDetails)
::ffff:192.168.24.241:42222: response
-> Response(200 OK, application/json, 44b)
::ffff:192.168.24.241:50453: response
-> Response(200 OK, application/json, 374b)

Die DTLS Verbindung zwischen der App und dem Gateway, erscheint jedoch nicht in dem Log des MITM.

File:Ikea-tradfri-update.png

2020-05-11T16:54:26Z

MMuszik: