A. What is Zap:
Zed Attack Proxy (ZAP) is one of the world’s most popular free security tool for penetration testing. Penetration testing commonly known as Pen Testing is the process of finding vulnerabilities in web applications .Penetration Testing provides an assurance to its users that their web application is safe from malicious attacks from the outer world . These attacks can cause harm to the integrity of an application.
The OWASP (Zed Attack Proxy) ZAP is an easy to use integrated penetration testing tool for finding vulnerabilities in your web applications. It is designed to be used by people with a wide range of security experience. ZAP is one of the most commonly used tools for penetration testing. This recently developed tool is ideal for developers, functional testers and security experts that use the tool for checking and testing their web app from any outside attack.
B. What’s new:
The next release of OWASP ZAP, planned is expected to include:
- OWASP rebranding
- Improvements in the passive and active automated scanners
- Improvements in the Spider
- The addition of a basic port scanner
- The ability to brute force files and directories.
C. Why is ZAP popular among Testers:
The evolution of the tool has completely revolutionized the world of Testing Web Applications. There were times when testing was considered to a be a tedious task which took a lot of time in testing the web applications.
- It was hard for manual testers to test nook and corner of their application for vulnerabilities.
- Things have changed now. With this tool the testers can easily test the applications in very less time.
- The tool has smoothened the process of testing thus making the task easy and less hectic for the testers.
D. How ZAP works:
- The tester inputs the test queries on the web browser from where it is carried forward to ZAP and then it is forwarded to the web server.
- From there the responses are send back to ZAP . Thereafter it is forwarded to the web browser which is then send back to the tester which views the responses to the test queries send.
E. Features:
The tool can easily be installed by the users in their devices which makes it more compatible and easy to use tool for performing penetration testing. An added advantage of the tool is its ability to mark out the parts where the defects are present. These viable defects once found can easily be resolved by the developer. Some of the features of this Penetration Testing Tool are listed below:
- Open source
- Cross platform
- Easy to install
- Completely free
- Easy to use
- Comprehensive help pages available
- Fully internationalized
- Translated into a dozen languages
- Community based, with involvement actively encouraged
- Under active development by an international team of volunteers
F. What are the Attacks well catered by ZAP:
Some of the possible attacks well catered by ZAP are as follows:
- Injection
- Broken Authentication and Session Management
- Cross Site Scripting
- Insecure Direct Object References
- Security Misconfiguration
- Sensitive Data Exposure
- Missing Function Level Access Control
- Cross Site Request Forgery
- Unvalidated Redirects and Forwards
The tool helps in removing most of the attacks possible in web application.
