Using the Zed Attack Proxy as a Web App testing tool
2 likes1,004 views
The document discusses configuring the Firefox web browser to work with the OWASP Zed Attack Proxy (ZAP) tool in order to conduct quasi-man-in-the-middle attacks against web applications for security testing purposes. It provides instructions for setting ZAP as the proxy in Firefox's network settings and enabling the ZAP plug-in to allow manual testing of vulnerabilities like SQL injection. The results of such security tests run with ZAP are then compiled.
1 of 8
More Related Content
What's hot (20)
Ad
Similar to Using the Zed Attack Proxy as a Web App testing tool (20)
Ad
More from David Sweigert (20)
Recently uploaded (20)
Using the Zed Attack Proxy as a Web App testing tool
- 1. Dave Sweigert, CISSP, CISA, PMP, Security+ OWASP (Zed Attack Proxy) Securing Web Apps with a quasi-man-in-the-middle (MitM) attack tool 11/25/2014 OWASP Zed Attack Proxy (ZAP) 1
- 2. Firefox configured to use proxy 11/25/2014 OWASP Zed Attack Proxy (ZAP) 2
- 3. FireFox Menu -- Tools – Options – Network -- Settings Set the host to localhost and the port to 8080, these are the default ZAP proxy ports. Use these settings for all protocols. 11/25/2014 OWASP Zed Attack Proxy (ZAP) 3
- 4. To enable FireFox Plug-in click Plug-n-Hack within the Quick Start Tab. 11/25/2014 OWASP Zed Attack Proxy (ZAP) 4
- 5. Configure automatic plug-in within FireFox 11/25/2014 OWASP Zed Attack Proxy (ZAP) 5
- 6. MANUAL intervention (using a Plug-N-Hack web page in the FireFox browser) allows manual testing of web services (e.g. SQL injection, etc.). These are manual tests typically run by a “human” penetration tester or software quality assurance (SQA) tester. 11/25/2014 OWASP Zed Attack Proxy (ZAP) 6
- 7. Test Results Compiled 11/25/2014 OWASP Zed Attack Proxy (ZAP) 7
- 8. References: https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project 11/25/2014 OWASP Zed Attack Proxy (ZAP) 8