OWSAP Zap Tool Execution - API Security Scan
- 2. OWSAP ZAP OWASP Zed Attack Proxy (ZAP) is an open-source web application security testing tool developed by the Open Web Application Security Project (OWASP). It is designed to help developers, security testers, and penetration testers identify vulnerabilities and security flaws in web applications. Why is it used? It is a tool used to enhance the security of web applications. Just as the security expert examines your building for vulnerabilities, using OWASP ZAP anyone with the right knowledge can examine web applications for potential security flaws that could be exploited by attackers. Scan for common security vulnerabilities, such as weak authentication mechanisms or input validation issues. Identify security weaknesses in their web applications. Mitigate risks by fixing the identified vulnerabilities before they can be exploited by malicious individuals.
- 3. Features of OWASP ZAP ZAP offers a wide range of features to assist in the identification and mitigation of web application vulnerabilities: Proxy Functionality: ZAP acts as a proxy between the user's browser and the target web application, allowing it to intercept and inspect the requests and responses exchanged. This enables the user to analyze and modify the application's communication in real-time. Active Scanning: ZAP includes a comprehensive set of active scanning tools that automatically test the target application for common security issues. These scans can help identify vulnerabilities such as cross-site scripting (XSS), SQL injection, and insecure direct object references. Passive Scanning: In addition to active scanning, ZAP performs passive scanning by observing the application's traffic and detecting potential security weaknesses. This includes identifying sensitive information leaks, insecure cookie settings, and other issues that may not be identified through active scanning alone. Spidering: ZAP's spidering functionality allows it to navigate through the target application, discovering and mapping out the various pages and functionalities. This helps in creating a comprehensive view of the application's structure, which is useful for testing and identifying potential vulnerabilities. Authentication and Session Management: ZAP provides features to assist in testing authentication and session management mechanisms. It allows users to define different user roles, perform login/logout operations, and manage session tokens to test the application's security controls effectively.
- 4. ZAP Desktop UI 1. Menu Bar – Provides access to many of the automated and manual tools. 2. Toolbar – Includes buttons which provide easy access to most commonly used features. 3. Tree Window – Displays the Sites tree and the Scripts tree. 4. Workspace Window – Displays requests, responses, and scripts and allows you to edit them. 5. Information Window – Displays details of the automated and manual tools. 6. Footer – Displays a summary of the alerts found and the status of the main automated tools.
- 5. Running an Automated Scan The easiest way to start using ZAP is via the Quick Start tab. Quick Start is a ZAP add-on that is included automatically when you installed ZAP. To run a Quick Start Automated Scan : 1. Start ZAP and click the Quick Start tab of the Workspace Window. 2. Click the large Automated Scan button. 3. In the URL to attack text box, enter the full URL of the web application you want to attack. 4. Click the Attack
- 6. View Alerts and Alert Details The left-hand side of the Footer contains a count of the Alerts found during your test, broken out into risk categories. These risk categories are: To view the alerts created during your test: Click the Alerts tab in the Information Window. Click each alert displayed in that window to display the URL and the vulnerability detected in the right side of the Information Window. In the Workspace Windows, click the Response tab to see the contents of the header and body of the response. The part of the response that generated the alert will be highlighted.
- 7. ZAP Tool Scan – Issues Types ZAP can scan through the web application and detect issues related to: • SQL injection • Broken Authentication • Sensitive data exposure • Broken Access control • Security misconfiguration • Cross Site Scripting (XSS) • Insecure Deserialization • Components with known vulnerabilities • Missing security headers
- 8. OWASP Cheat Sheet Series The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics URL: https://cheatsheetseries.owasp.org/ We can use the above URL to fix the issues from ZAP tool scanning
- 9. Steps to Scan the Diff. JSON Step:1
- 10. Steps to Scan the Diff. JSON Step:2
- 11. Steps to Scan the Diff. JSON Step:3
- 12. Restriction Methods – Attack of ZAP Tool Resource Whitelisting Parameter Whitelisting Proper Return Type Improve / Add DTO Avoid Complex Object Parameters Attribute routing Exception Handling Taking care of response content URL and file Injection prevention