Instructor: OWASP ZAP. 2 2
In this lesson, we're going to talk about 3 3
the OWASP Foundation's ZAP program. 4 4
Now Zap is the Zed Attack Proxy, also known as ZAP. 5 5
It's an open-source interception proxy 6 6
and web application assessment tool that's written in Java. 7 7
Now, because it's written in Java, 8 8
it works on Windows systems, Linux systems, 9 9
and Mac systems, just like Burp Suite does. 10 10
Now, this is an open-source program, 11 11
which means you can actually take that code 12 12
and modify it to your heart's content and they won't mind. 13 13
Now, just like Burp Suite, 14 14
OWASP ZAP does include crawlers to automate the discovery 15 15
of links and content within a web application. 16 16
So for example, here on the screen, 17 17
you can see that the tool has connected to that web server 18 18
and it's starting to find all of the different webpages 19 19
that are associated with this particular website. 20 20
So we have 515support.com, 21 21
515support.com/robots.txt, /sitemap.xml, /dvwa, /dvwa/dvwa. 22 22
And it will keep going on and on 23 23
until it finds all the webpages on the site. 24 24
It's a great way for it to index the site 25 25
so you can then look for vulnerabilities in those pages. 26 26
Now, in addition to that, OWASP ZAP will also include 27 27
automated vulnerability scanning by using its scan engine. 28 28
To do this, you're going to end up setting up a scan policy, 29 29
much like you do with Nessus, 30 30
and then it will be able to go through 31 31
and look for those things 32 32
based on the different plugins that you have. 33 33
For instance, if you decide you wanted to use a scam policy 34 34
to be able to detect the client browser 35 35
or to conduct information gathering 36 36
or trying to do injections, 37 37
you could do all of that from within this tool. 38 38
Now, in addition to all of that 39 39
it also has this nice feature called the Heads Up Display 40 40
or HUD mode. 41 41
This provides alert indications and scan tools 42 42
within your browser when you go and open pages 43 43
within a website. 44 44
So if I open up my web browser 45 45
and I'm scanning this website, which happens to be DVWA, 46 46
I can actually go through 47 47
and you'll see there's those tools on the left-hand side. 48 48
Notice at the top bar, it's highlighted in orange 49 49
and on the left side I have different tools. 50 50
Based on that toolbar on the left-hand side, 51 51
I can see that there is one orange alert 52 52
and four yellow alerts, 53 53
and if I click on those 54 54
I would get more information about them. 55 55
On the right-hand side 56 56
I can get different information about the different sites. 57 57
I can start crawling, I can do some kind of exploitations 58 58
on them and other things all from within this web browser 59 59
because it's integrating with this toolset. 60 60
Now for the exam, again, you do not need to know 61 61
how to use the OWASP ZAP tool. 62 62
It's something that's great for you to spend some time in 63 63
and gain to understand it, but for the exam 64 64
you don't have to. 65 65
You should be aware of what this tool is. 66 66
It's an intercept proxy and it has the ability 67 67
to do web application vulnerability scanning as well. 68 68
That's as deep as you need to know 69 69
when we talk about the OWASP ZAP for the CySA+ exam. 70 70
Now, in the real world 71 71
you'll probably want to get comfortable 72 72
using something like Burp Suite or the OWASP ZAP tool 73 73
because it will help you 74 74
as you do your web application scanning 75 75
and vulnerability assessments.