1 1 00:00:00,360 --> 00:00:02,280 OWASP ZAP. 2 2 00:00:02,280 --> 00:00:04,020 In this lesson, we're going to talk about 3 3 00:00:04,020 --> 00:00:06,750 the OWASP Foundation's ZAP program. 4 4 00:00:06,750 --> 00:00:10,890 Now Zap is the Zed Attack Proxy, also known as ZAP. 5 5 00:00:10,890 --> 00:00:12,960 It's an open-source interception proxy 6 6 00:00:12,960 --> 00:00:16,110 and web application assessment tool that's written in Java. 7 7 00:00:16,110 --> 00:00:17,460 Now, because it's written in Java, 8 8 00:00:17,460 --> 00:00:19,860 it works on Windows systems, Linux systems, 9 9 00:00:19,860 --> 00:00:22,710 and Mac systems, just like Burp Suite does. 10 10 00:00:22,710 --> 00:00:24,570 Now, this is an open-source program, 11 11 00:00:24,570 --> 00:00:26,130 which means you can actually take that code 12 12 00:00:26,130 --> 00:00:29,190 and modify it to your heart's content and they won't mind. 13 13 00:00:29,190 --> 00:00:30,900 Now, just like Burp Suite, 14 14 00:00:30,900 --> 00:00:33,840 OWASP ZAP does include crawlers to automate the discovery 15 15 00:00:33,840 --> 00:00:36,780 of links and content within a web application. 16 16 00:00:36,780 --> 00:00:38,610 So for example, here on the screen, 17 17 00:00:38,610 --> 00:00:41,070 you can see that the tool has connected to that web server 18 18 00:00:41,070 --> 00:00:43,800 and it's starting to find all of the different webpages 19 19 00:00:43,800 --> 00:00:46,140 that are associated with this particular website. 20 20 00:00:46,140 --> 00:00:47,873 So we have 515support.com, 21 21 00:00:47,873 --> 00:00:52,873 515support.com/robots.txt, /sitemap.xml, /dvwa, /dvwa/dvwa. 22 22 00:00:57,210 --> 00:00:58,530 And it will keep going on and on 23 23 00:00:58,530 --> 00:01:01,140 until it finds all the webpages on the site. 24 24 00:01:01,140 --> 00:01:03,000 It's a great way for it to index the site 25 25 00:01:03,000 --> 00:01:05,850 so you can then look for vulnerabilities in those pages. 26 26 00:01:05,850 --> 00:01:08,520 Now, in addition to that, OWASP ZAP will also include 27 27 00:01:08,520 --> 00:01:12,240 automated vulnerability scanning by using its scan engine. 28 28 00:01:12,240 --> 00:01:14,670 To do this, you're going to end up setting up a scan policy, 29 29 00:01:14,670 --> 00:01:16,200 much like you do with Nessus, 30 30 00:01:16,200 --> 00:01:17,670 and then it will be able to go through 31 31 00:01:17,670 --> 00:01:19,050 and look for those things 32 32 00:01:19,050 --> 00:01:21,210 based on the different plugins that you have. 33 33 00:01:21,210 --> 00:01:23,970 For instance, if you decide you wanted to use a scam policy 34 34 00:01:23,970 --> 00:01:25,740 to be able to detect the client browser 35 35 00:01:25,740 --> 00:01:27,330 or to conduct information gathering 36 36 00:01:27,330 --> 00:01:28,890 or trying to do injections, 37 37 00:01:28,890 --> 00:01:31,920 you could do all of that from within this tool. 38 38 00:01:31,920 --> 00:01:33,270 Now, in addition to all of that 39 39 00:01:33,270 --> 00:01:36,210 it also has this nice feature called the Heads Up Display 40 40 00:01:36,210 --> 00:01:37,500 or HUD mode. 41 41 00:01:37,500 --> 00:01:40,230 This provides alert indications and scan tools 42 42 00:01:40,230 --> 00:01:42,840 within your browser when you go and open pages 43 43 00:01:42,840 --> 00:01:44,160 within a website. 44 44 00:01:44,160 --> 00:01:45,690 So if I open up my web browser 45 45 00:01:45,690 --> 00:01:49,170 and I'm scanning this website, which happens to be DVWA, 46 46 00:01:49,170 --> 00:01:50,190 I can actually go through 47 47 00:01:50,190 --> 00:01:53,550 and you'll see there's those tools on the left-hand side. 48 48 00:01:53,550 --> 00:01:56,010 Notice at the top bar, it's highlighted in orange 49 49 00:01:56,010 --> 00:01:58,470 and on the left side I have different tools. 50 50 00:01:58,470 --> 00:02:00,390 Based on that toolbar on the left-hand side, 51 51 00:02:00,390 --> 00:02:02,340 I can see that there is one orange alert 52 52 00:02:02,340 --> 00:02:03,450 and four yellow alerts, 53 53 00:02:03,450 --> 00:02:04,530 and if I click on those 54 54 00:02:04,530 --> 00:02:06,540 I would get more information about them. 55 55 00:02:06,540 --> 00:02:07,590 On the right-hand side 56 56 00:02:07,590 --> 00:02:09,780 I can get different information about the different sites. 57 57 00:02:09,780 --> 00:02:12,930 I can start crawling, I can do some kind of exploitations 58 58 00:02:12,930 --> 00:02:16,110 on them and other things all from within this web browser 59 59 00:02:16,110 --> 00:02:18,600 because it's integrating with this toolset. 60 60 00:02:18,600 --> 00:02:21,300 Now for the exam, again, you do not need to know 61 61 00:02:21,300 --> 00:02:23,790 how to use the OWASP ZAP tool. 62 62 00:02:23,790 --> 00:02:25,620 It's something that's great for you to spend some time in 63 63 00:02:25,620 --> 00:02:27,630 and gain to understand it, but for the exam 64 64 00:02:27,630 --> 00:02:29,070 you don't have to. 65 65 00:02:29,070 --> 00:02:31,050 You should be aware of what this tool is. 66 66 00:02:31,050 --> 00:02:33,450 It's an intercept proxy and it has the ability 67 67 00:02:33,450 --> 00:02:36,300 to do web application vulnerability scanning as well. 68 68 00:02:36,300 --> 00:02:37,860 That's as deep as you need to know 69 69 00:02:37,860 --> 00:02:41,490 when we talk about the OWASP ZAP for the CySA+ exam. 70 70 00:02:41,490 --> 00:02:42,660 Now, in the real world 71 71 00:02:42,660 --> 00:02:44,040 you'll probably want to get comfortable 72 72 00:02:44,040 --> 00:02:47,280 using something like Burp Suite or the OWASP ZAP tool 73 73 00:02:47,280 --> 00:02:48,180 because it will help you 74 74 00:02:48,180 --> 00:02:49,950 as you do your web application scanning 75 75 00:02:49,950 --> 00:02:51,450 and vulnerability assessments.