OWASP ZAP - Revision history

NGallmetzer: added link to official API documentation

2025-01-18T23:29:28Z

added link to official API documentation

← Older revision		Revision as of 23:29, 18 January 2025
Line 131:		Line 131:
	==References==		==References==
	* [https://www.zaproxy.org/docs/ Official Documentation for ZAP]		* [https://www.zaproxy.org/docs/ Official Documentation for ZAP]
			* [https://www.zaproxy.org/docs/api/ Official API documentation]
	* R. S. Devi and M. M. Kumar, "Testing for Security Weakness of Web Applications using Ethical Hacking," 2020 4th International Conference on Trends in Electronics and Informatics (ICOEI)(48184), Tirunelveli, India, 2020, pp. 354-361, doi: 10.1109/ICOEI48184.2020.9143018.[https://ieeexplore.ieee.org/document/9143018]		* R. S. Devi and M. M. Kumar, "Testing for Security Weakness of Web Applications using Ethical Hacking," 2020 4th International Conference on Trends in Electronics and Informatics (ICOEI)(48184), Tirunelveli, India, 2020, pp. 354-361, doi: 10.1109/ICOEI48184.2020.9143018.[https://ieeexplore.ieee.org/document/9143018]

NGallmetzer: Reorganized the article structure for better clarity and readability. Expanded the introduction with a brief description of ZAP. Added a short section on the history of ZAP. Revised and clarified several sections for improved readability and structure (e.g., Test Target, Sessions). Created a new section on reporting. Added new tutorial videos to the article.

2025-01-18T23:25:35Z

Reorganized the article structure for better clarity and readability. Expanded the introduction with a brief description of ZAP. Added a short section on the history of ZAP. Revised and clarified several sections for improved readability and structure (e.g., Test Target, Sessions). Created a new section on reporting. Added new tutorial videos to the article.

Show changes

Ikramer at 17:50, 12 March 2024

2024-03-12T17:50:01Z

← Older revision		Revision as of 17:50, 12 March 2024
Line 121:		Line 121:
	* [https://www.zaproxy.org/docs/ Official Documentation for ZAP]		* [https://www.zaproxy.org/docs/ Official Documentation for ZAP]
	* R. S. Devi and M. M. Kumar, "Testing for Security Weakness of Web Applications using Ethical Hacking," 2020 4th International Conference on Trends in Electronics and Informatics (ICOEI)(48184), Tirunelveli, India, 2020, pp. 354-361, doi: 10.1109/ICOEI48184.2020.9143018.[https://ieeexplore.ieee.org/document/9143018]		* R. S. Devi and M. M. Kumar, "Testing for Security Weakness of Web Applications using Ethical Hacking," 2020 4th International Conference on Trends in Electronics and Informatics (ICOEI)(48184), Tirunelveli, India, 2020, pp. 354-361, doi: 10.1109/ICOEI48184.2020.9143018.[https://ieeexplore.ieee.org/document/9143018]


			[[Category:Documentation]]

			[[Category:Pentesting]]

JDimmel: grammar correction, restructuring of sentences and some rewriting

2023-01-08T15:59:54Z

grammar correction, restructuring of sentences and some rewriting

JDimmel: added short mention about ajax spider

2023-01-08T15:42:08Z

added short mention about ajax spider

← Older revision		Revision as of 15:42, 8 January 2023
Line 73:		Line 73:
	=== Spider ===		=== Spider ===
	[[File:Zap-spider.png\|thumb\|ZAP Spider]]		[[File:Zap-spider.png\|thumb\|ZAP Spider]]
	After starting an automated scan the Spider tab opens up in ZAP. The Spider ~~"crawls"~~ through the web application and tries to find every page of the web application.		After starting an automated scan, the Spider tab opens up in ZAP. The Spider “crawls” through the web application and tries to find every page of the web application. Optionally, a more advanced AJAX spider
			for AJAX-rich sites can be used.

	===Add-Ons===		===Add-Ons===
	There is a '''Marketplace''' for ZAP where extra Add-ons for ZAP can be found. These make it possible to extend the functionality of ZAP even further, and typically it is possible to add or remove them without restarting the ZAP application.		There is a '''Marketplace''' for ZAP where extra Add-ons for ZAP can be found. These make it possible to extend the functionality of ZAP even further, and typically it is possible to add or remove them without restarting the ZAP application.

JDimmel: grammar correction and some rewriting

2023-01-08T15:36:44Z

grammar correction and some rewriting

← Older revision		Revision as of 15:36, 8 January 2023
Line 17:		Line 17:

	=== Description ===		=== Description ===
	ZAP’s focus is on testing web applications. The core idea behind it, is a ”Man-in-the-Middle proxy” that is placed between the ~~clients~~ browser and the web application. HTTP requests and responses can be intercepted, inspected and even modified before they are forwarded to their actual destination.		ZAP’s focus is on testing web applications. The core idea behind it, is a ”Man-in-the-Middle proxy” that is placed between the client's browser and the web application. HTTP requests and responses can be intercepted, inspected and even modified before they are forwarded to their actual destination.
	There are different ways to run ZAP, it is possible to use it as a stand-alone application (Java 8+ is required) or as a daemon process.		There are different ways to run ZAP, it is possible to use it as a stand-alone application (Java 8+ is required) or as a daemon process.

	~~Addtionally~~, it is possible to run ZAP in combination with another proxy, e.g. if a company runs their web traffic through their own proxy or firewall solution first. In this case we configure our browser to connect to ZAP and then we can configure ZAP to connect to the proxy of the company.		Additionally, it is possible to run ZAP in combination with another proxy, e.g. if a company runs their web traffic through their own proxy or firewall solution first. In this case we configure our browser to connect to ZAP and then we can configure ZAP to connect to the proxy of the company.

	There are various Add-ons as well as an API, which enhance the functionality and features of ZAP.		There are various Add-ons, as well as an API, which enhance the functionality and features of ZAP.
	As stated in the principles, ZAP targets all skill levels~~, from~~ those new to security testing who ~~will probably~~ start out by using automated tests, to developers that run security tests for a living and which make use of a variety of features including manual tests. The flexibility and extensibility (via add-ons in the ZAP marketplace) that ZAP provides, makes it a popular choice among security testers.		As stated in the principles, ZAP targets all skill levels. Beginning with those who are new to security testing, who are likely to start out using automated tests, to developers that run security tests for a living and which make use of a variety of features including manual tests. The flexibility and extensibility (via add-ons in the ZAP marketplace) that ZAP provides, makes it a popular choice among security testers.
	Since we’re talking about security, to a lot of people it is also important to know what their security tools really can do. ZAP is open source and code examination is possible. If desired, one can look at how certain functions are implemented. The developers are transparent about which data ZAP is collecting (e.g. checks for new versions) and also how that background data can be controlled or even disabled (where possible).		Since we’re talking about security, to a lot of people, it is also important to know what their security tools really can do. ZAP is open source and code examination is possible. If desired, one can look at how certain functions are implemented. The developers are transparent about which data ZAP is collecting (e.g. checks for new versions) and also how that background data can be controlled or even disabled (where possible).
	The ZAP community is also very open to new developers, anyone can submit bug fixes or create additional features for ZAP.		The ZAP community is also very open to new developers, anyone can submit bug fixes or create additional features for ZAP.

JDimmel: Added an additional example where ZAP can be tested on

2023-01-08T15:28:31Z

Added an additional example where ZAP can be tested on

← Older revision		Revision as of 15:28, 8 January 2023
Line 36:		Line 36:

	=== Test target ===		=== Test target ===
	If you want to try out the features of ZAP and do not want to set up your own server, you can find places like [https://public-firing-range.appspot.com/ https://public-firing-range.appspot.com/] which is a free-to-use online installation of Google's Firing Range. Do NOT run active features of ZAP against public websites without permission, you might alter data and this kind of attack can be prosecuted!		If you want to try out the features of ZAP and do not want to set up your own server, you can find places like [https://public-firing-range.appspot.com/ https://public-firing-range.appspot.com/] which is a free-to-use online installation of Google's Firing Range. Alternatively, an online accessible OWASP Juice Shop instance like the [//juice-shop.herokuapp.com official one] can be used to run try out and learn ZAP. Do NOT run active features of ZAP against public websites without permission, you might alter data and this kind of attack can be prosecuted!

	===Persistent Sessions===		===Persistent Sessions===

JDimmel: Updated required Java version

2023-01-08T15:15:58Z

Updated required Java version

← Older revision		Revision as of 15:15, 8 January 2023
Line 33:		Line 33:
	First, go to the [https://www.zaproxy.org/download/ Download section on the official website for ZAP] and select the installer for your operating system.		First, go to the [https://www.zaproxy.org/download/ Download section on the official website for ZAP] and select the installer for your operating system.

	Additionally, Java version 8 or higher must be installed. There are no additional requirements.		Additionally, Java version 11 or higher must be installed. There are no additional requirements.

	=== Test target ===		=== Test target ===

JDimmel: /* About */

2023-01-08T15:07:22Z

About

SKoc: updated

2022-01-16T15:46:31Z

updated

← Older revision		Revision as of 15:46, 16 January 2022
Line 104:		Line 104:

	===Passive versus Active Scanning===		===Passive versus Active Scanning===
	Passive scanning is considered safe and legal~~, too, it~~ is used to find vulnerabilities ~~and none of the~~ requests ~~or responses change~~. It is also run in a background thread so it does not negatively affect the performance when exploring an application.		Passive scanning is considered safe and legal. It is used to find vulnerabilities without modifying requests nor malicious actions. It is also run in a background thread so it does not negatively affect the performance when exploring an application.

	~~With~~ Active Scanning ~~we might actually attack our target so this~~ should be ~~done with caution and~~ of ~~course permission only, we could end up altering data at~~ the target ~~site with an active scan~~.		Active Scanning is considered malicious and should only be used when verbal or written permission of the owner of the target web application is acquired. Active Scan is defaultly running in Standard and Attack Mode.

	Limitations of a standard passive scan are that pages that require a login can not be accessed by ZAP since the authentication will not be handled by ZAP. It is, however, possible to configure the functionality to authenticate. Another limitation is that the sequence in which a passive scan explores the target is pretty much uncontrollable. But ZAP offers a solution for almost every limitation, and that means there are many extra features in ZAP for exploring and attacking other than the passive scan. For exploring a site we already mentioned spidering as a viable option but we need to keep in mind that they also are rather limited when it comes to filling out forms, they may enter default data or random strings instead of the required information. So it is suggested that spidering is used in combination with manual exploration, so that an actual user can, for example, fill out form data if an error message is returned.		Limitations of a standard passive scan are that pages that require a login can not be accessed by ZAP since the authentication will not be handled by ZAP. It is, however, possible to configure the functionality to authenticate. Another limitation is that the sequence in which a passive scan explores the target is pretty much uncontrollable. But ZAP offers a solution for almost every limitation, and that means there are many extra features in ZAP for exploring and attacking other than the passive scan. For exploring a site we already mentioned spidering as a viable option but we need to keep in mind that they also are rather limited when it comes to filling out forms, they may enter default data or random strings instead of the required information. So it is suggested that spidering is used in combination with manual exploration, so that an actual user can, for example, fill out form data if an error message is returned.

← Older revision		Revision as of 15:59, 8 January 2023
Line 36:		Line 36:

	=== Test target ===		=== Test target ===
	If you want to try out the features of ZAP and do not want to set up your own server, you can find places like [https://public-firing-range.appspot.com/ ~~https://public-firing-range.appspot.com/~~] which is a free-to-use online installation of Google's Firing Range. Alternatively, an online accessible OWASP Juice Shop instance like the [//juice-shop.herokuapp.com official one] can be used to ~~run~~ try out and learn ZAP. Do NOT run active features of ZAP against public websites without permission, you might alter data and this kind of attack can be prosecuted!		If you want to try out the features of ZAP and do not want to set up your own server, you can find places like [https://public-firing-range.appspot.com/ Firing Range], which is a free-to-use online installation of Google's Firing Range. Alternatively, an online accessible OWASP Juice Shop instance like the [//juice-shop.herokuapp.com official one] can be used to try out and learn ZAP. Do NOT run active features of ZAP against public websites without permission, you might alter data and this kind of attack can be prosecuted!

	===Persistent Sessions===		===Persistent Sessions===
	[[File:Zap-persist session.png\|thumb\|ZAP Session Persistence]]		[[File:Zap-persist session.png\|thumb\|ZAP Session Persistence]]
	After opening ZAP you are asked if you want to persist the session.		After opening ZAP you are asked if you want to persist the session.
	ZAP is able to save its sessions. In other words, collected and ~~analysed~~ data from web applications are saved. It enables the user to continue their analysis of the ~~webapplication~~ without the need to reach the web application.		ZAP is able to save its sessions. In other words, collected and analyzed data from web applications are saved. It enables the user to continue their analysis of the web application without the need to reach the web application.
	Caution is advised. The more aggressive ZAP is attacking, the more data will be collected. A few minutes of scanning can result to hundreds of Megabytes.		Caution is advised. The more aggressive ZAP is attacking, the more data will be collected. A few minutes of scanning can result in hundreds of Megabytes.

	===Modes===		===Modes===
	ZAP has different modes to to choose from:		ZAP has different modes to choose from:
	* Safe: ~~only~~ allows operations, that are not considered dangerous. Dangerous meaning, manipulating requests and attacking the web application		* Safe: Only allows operations, that are not considered dangerous. Dangerous meaning, manipulating requests and attacking the web application
	* Protected: the officially recommended mode. it allows dangerous operations, but only on URLs that were put in the Scope of our target or in other words, only selected sites will be attacked.		* Protected: This is the officially recommended mode. It allows dangerous operations, but only on URLs that were put in the Scope of our target or in other words, only selected sites will be attacked.
	* Standard: ZAP is ~~allow to~~ to do anything to the web application		* Standard: ZAP is allowed to do anything to the web application
	* ATTACK: ZAP actively scans new nodes as soon as they are discovered.		* ATTACK: ZAP actively scans new nodes as soon as they are discovered.

	===~~Quickstart~~/Automated Scan===		===Quick Start/Automated Scan===
	[[File:Zap-quickstart.png\|thumb\|ZAP ~~Quickstart~~]]		[[File:Zap-quickstart.png\|thumb\|ZAP Quick Start]]
	The easiest way to start using ZAP is via the Quick Start tab.		The easiest way to start using ZAP is via the Quick Start tab.
	To run a Quick Start/Automated Scan:		To run a Quick Start/Automated Scan:
Line 69:		Line 69:
	* Click the Launch Browser		* Click the Launch Browser

	Next you will be presented with a welcome message that includes the HUD tutorial (see figure ~~"ZAP~~ HUD Welcome ~~Message"~~)		Next, you will be presented with a welcome message that includes the HUD tutorial (see figure “ZAP HUD Welcome Message”)

	=== Spider ===		=== Spider ===
Line 76:		Line 76:
	for AJAX-rich sites can be used.		for AJAX-rich sites can be used.

	===Add-~~Ons~~===		===Add-ons===
	There is a '''Marketplace''' for ZAP where extra Add-ons for ZAP can be found. These make it possible to extend the functionality of ZAP even further, and typically it is possible to add or remove them without restarting the ZAP application.		There is a '''Marketplace''' for ZAP where extra Add-ons for ZAP can be found. These make it possible to extend the functionality of ZAP even further, and typically it is possible to add or remove them without restarting the ZAP application.
	Usually Add-ons are assigned one of the following states:		Usually, Add-ons are assigned one of the following states:
	* Release: high-quality add-on		* Release: high-quality add-on
	* Beta: reasonable quality but possibly incomplete or still requires testing • Alpha: requires further development		* Beta: reasonable quality but possibly incomplete or still requires testing • Alpha: requires further development

	[[File:Zap-addons.png\|thumb\|Manage Add-~~Ons~~]]		[[File:Zap-addons.png\|thumb\|Manage Add-ons]]
	You can reach the marketplace by clicking on the blue-red-green squares symbol in the UI, it stands for ~~"Manage~~ Add-~~Ons"~~.		You can reach the marketplace by clicking on the blue-red-green squares symbol in the UI, it stands for “Manage Add-ons”.

	===User Agent Settings===		===User Agent Settings===
Line 101:		Line 101:
	One of the many guides found at the ZAP website is about how to attack the Top 10 security threats using ZAP.		One of the many guides found at the ZAP website is about how to attack the Top 10 security threats using ZAP.
	The content of the following tables is taken from the [https://www.zaproxy.org/docs/guides/zapping-the-top-10-2021/ Zapping the Top 10 Guide].		The content of the following tables is taken from the [https://www.zaproxy.org/docs/guides/zapping-the-top-10-2021/ Zapping the Top 10 Guide].
	The last OWASP Top 10 was 2017. ~~Current~~ OWASP Top 10 is from 2021, which has three new categories, with naming and scoping changes, and some combined vulnerabilities in the Top 10 for 2021.		The last OWASP Top 10 was 2017. The current OWASP Top 10 is from 2021, which has three new categories, with naming and scoping changes, and some combined vulnerabilities in the Top 10 for 2021.
	More information about the Top 10 can be found on their [https://owasp.org/www-project-top-ten OWASP Top Ten Page].		More information about the Top 10 can be found on their [https://owasp.org/www-project-top-ten OWASP Top Ten Page].
	[[File:OwaspTop10.png\|thumb\|none\|upright=2.0\|OWASP Top 10 2021]]		[[File:OwaspTop10.png\|thumb\|none\|upright=2.0\|OWASP Top 10 2021]]

	===Passive versus Active Scanning===		===Passive versus Active Scanning===
	Passive scanning is considered safe and legal. It is used to find vulnerabilities without modifying requests nor malicious actions. It is also run in a background thread so it does not negatively affect the performance when exploring an application.		Passive scanning is considered safe and legal. It is used to find vulnerabilities without modifying requests nor malicious actions. It is also run in a background thread, so it does not negatively affect the performance when exploring an application.

	Active Scanning is considered malicious and should only be used when verbal or written permission of the owner of the target web application is acquired. Active Scan is ~~defaultly~~ running in Standard and Attack Mode.		Active Scanning is considered malicious and should only be used when verbal or written permission of the owner of the target web application is acquired. Active Scan is running by default in Standard and Attack Mode.

	Limitations of a standard passive scan are that pages that require a login can not be accessed by ZAP since the authentication will not be handled by ZAP. It is, however, possible to configure the functionality to authenticate. Another limitation is that the sequence in which a passive scan explores the target is pretty much uncontrollable. But ZAP offers a solution for almost every limitation, and that means there are many extra features in ZAP for exploring and attacking other than the passive scan. For exploring a site we already mentioned spidering as a viable option but we need to keep in mind that they also are rather limited when it comes to filling out forms~~, they~~ may ~~enter~~ default data or random strings instead of the required information. So it is suggested that spidering is used in combination with manual exploration, so that an actual user can, for example, fill out form data if an error message is returned.		Limitations of a standard passive scan are that pages that require a login can not be accessed by ZAP, since the authentication will not be handled by ZAP. It is, however, possible to configure the functionality to authenticate. Another limitation is that the sequence in which a passive scan explores the target is pretty much uncontrollable. But ZAP offers a solution for almost every limitation, and that means there are many extra features in ZAP for exploring and attacking other than the passive scan. For exploring a site, we already mentioned spidering as a viable option, but we need to keep in mind that they also are rather limited when it comes to filling out forms. Forms may be filled with default data or random strings instead of the required information. So it is suggested that spidering is used in combination with manual exploration, so that an actual user can, for example, fill out form data if an error message is returned.

	Another recommendation for exploration is to take a look at the web application with a browser proxying through ZAP~~, the~~ benefit of this method is that all requests and responses undergo a passive scan by ZAP and a site tree is built. Additionally, ZAP will record potential vulnerabilities that it finds for future reference.		Another recommendation for exploration is to take a look at the web application with a browser proxying through ZAP. The benefit of this method is that all requests and responses undergo a passive scan by ZAP and a site tree is built. Additionally, ZAP will record potential vulnerabilities that it finds for future reference.

	== Videos ==		== Videos ==

← Older revision		Revision as of 15:07, 8 January 2023
Line 4:		Line 4:

	The principles are:		The principles are:
	* It is free and open source so anyone can access and use it.		* It is free and open source, so anyone can access and use it.
	* It is cross platform(Windows, Linux, ~~MacOS~~		* It is cross-platform (Windows, Linux, macOS, Docker)
	* It is newcomer friendly, but offers advanced and more complex functions as well.		* It is newcomer friendly, but offers advanced and more complex functions as well.
	* It is easy to install; it requires Java Runtime Environment but everything else is included in standard downloads.		* It is easy to install; it requires Java Runtime Environment, but everything else is included in standard downloads.
	* It is fully internationalized, i.e., it has been translated to many other languages.		* It is fully internationalized, i.e., it has been translated to many other languages.
	* It is fully documented, set of useful documents and helpline files are included.		* It is fully documented, meaning it has a set of useful documents and helpline files are included.
	* It works well with ~~addtional~~ third-party tools. For example: Automation		* It works well with additional third-party tools. For example: Automation
	* It supports the use of well-regarded components.		* It supports the use of well-regarded components.
	These principles can be seen as the motivation behind ZAP. To ~~summarise~~, it is designed to give everyone interested the chance to easily run security tests, without depending on ~~money~~ or skills.		These principles can be seen as the motivation behind ZAP. To summarize, it is designed to give everyone interested in web security the chance to easily run security tests, without depending on paid software or advanced skills.
	OWASP (Open Web Application Security Project) is a non-profit ~~organisation~~ that publishes freely-available articles and aside from tools like ZAP, they also provide documentation and technologies, that deal with web application security. Many security publications refer to the OWASP publications. ~~One~~ example ~~are~~ OWASP Top 10, which is looking at the biggest security risks for ~~organisations~~. OWASP Top 10 will be covered in more detail in another chapter.		OWASP (Open Web Application Security Project) is a non-profit organization that publishes freely-available articles and aside from tools like ZAP, they also provide documentation and technologies, that deal with web application security. Many security publications refer to the OWASP publications. An example is the OWASP Top 10, which is looking at the biggest security risks for organizations. OWASP Top 10 will be covered in more detail in another chapter.
	They also offer a testing guide as well as a development guide, offering best practice information to those interested and many more interesting resources.		They also offer a testing guide as well as a development guide, offering best practice information to those interested, and many more interesting resources.

	=== Description ===		=== Description ===