STARTING WITH ZAP ( ZED ATTACK PROXY )

What is ZAP ?

Zed Attack Proxy also know as ZAP is one of the most powerful open source penetration testing tool available in the market to find out the security loop holes we have in the web application and this can be most useful to pen testers,functional tester and security testing teams.

Download & Installation:

Zap can be downloaded and installed for use on different platforms like Windows, Linux/Cross Platform, Mac OS/X and the different platform setup files can be downloaded from  https://code.google.com/p/zaproxy/wiki/Downloads?tm=2 Once the download is complete we can start installation process and install it on our machine and then zap will be ready for use.

Getting Started With Zap:

How to use ?

Zap is mainly used to attack the web application scan it completely and show the users all the security loop holes or bugs we have in the application. This attack can be done in two ways.

1. Using URL to attack on Quick Start Tab
2. Setting as an Intercepting proxy

Using the above two ways we can see the same result. But the limitation we have using we need to input in each URL and then attack. Now lets see how we can attack a web application using these methods.

Using URL to attack on Quick Start Tab:

Type/Copy paste the URL in the box and click on Attack button below and we can see the ZAP actively scanning URL we provided and by the end of the scanning we can see the results displayed in the alerts tab with alerts levels set to High,Medium,Low. This results even display if there is any possible SQL injections and in that case ZAP provides users with predefined SQL injection queries which can be found using Fuzzer.

Setting as an Intercepting proxy:

We need to configure any browser available on our machine to connect to the web application we wish to test through ZAP. Once the proxy settings are established on our browser ZAP allows us to see all of the requests we make to a web app and all of the responses we receive from it. Now lets see how to configure proxies on different browsers.

Configuring Proxies On Different Browsers:

First we need to click on Settings in ZAP and that opens up the ZAP settings pop-up 

Under this settings pop-up we need to click on Local proxy and this gives us an option to enter the proxy address and port, by default this shows as localhost and 8080 we can either rename and change the value or leave it as it is and click on OK button below.

Chrome (on Windows)
 
Press-Settings on Google Chrome button (top right)
 
Select-Click on 'Show advanced settings'
 
Scroll down to find 'Network'

Press-'Change proxy settings' button
 
Press-'LAN Settings' button
 
Check 'Proxy Server' check box

This enables the Proxy 'Address' & 'Port' fields

Enter in the'HTTP Proxy:' & 'Port'field the 'Address' & 'Port' values we configured in the Options Local Proxy screen on ZAP

Click on 'OK' button

Firefox
 
Select-'Tools' menu
 
Select-'Options' menu item
 
Click'Advanced' button
 
Click on-'Network' tab
 
Click-'Settings...' button
 
Select-'Manual proxy configuration' radio button
 
Enter in the'HTTP Proxy:' & 'Port'field the 'Address' & 'Port' values we configured in the Options Local Proxy screen on ZAP
 
Click-Connection Setting 'OK' button
 
Click 'OK' button

Internet Explorer
 
Click on 'Internet Options' on top right of the browser
 
Click on the 'Connections' tab
 
Press the'LAN Settings' button
 
Check 'Proxy Server' check box

This enables the Proxy 'Address' & 'Port' fields

Enter in the'HTTP Proxy:' & 'Port'field the 'Address' & 'Port' values we configured in the Options Local Proxy screen on ZAP

Click on 'OK' button

Once the proxy settings are done run any web application on the browser which is configured with proxy. Now going back to ZAP on the left side under sites we can find all the pages we have browsed under the alerts tab we can see all the alerts categorized into High,Medium,Low priorities  we have on all the pages we have browsed through. Incase if there is any possible sql injection it shows in the alert tab and ZAP provides users with predefined SQL injection queries which can be found using Fuzzer.


REFERENCES:
https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project

THANKS FOR RUNNING THROUGH MY BLOG

MORE WAYS OF EXPLORING ZAP TO COME ON ITS WAY!!

Know Tamper Data

What is tamper data?

Tamper Data is a Firefox Extension which gives users the power to view, record and even modify outgoing HTTP requests. It is simple yet effective tool which can be used to do penetration testing. Using this tool we can trace and time the http/https connections, responses and parameters being sent.

Download & Install Tamper data

Open your Mozilla fire fox browser on your machine( if already installed on your machine ) else you need to first download and install Mozilla fire fox browser on you machine in-order to use this tool. Now type "Tamper data add on" in google search.

Now click on the search result which is coming from the link https://addons.mozilla.org/en-US/firefox/addon/tamper-data this should redirect you to the page showing Tamper data add on by 'Adam Judson'

Click on the "Add to Firefox "option here and that will  start your download and will ask you to install it on your Firefox browser.Once the installation is done it will prompt to restart your browser and by clicking on "Restart Now",it will  restart your browser

How to use ?

Once the donwload and installation process is completed, on opening  the Firefox browser click on "Tools option" under this you can find Tamper data listed.

Clicking on the tamper data  will open up a Tamper Data window as shown below, with different columns like Time,Duration,Total Duration,Size,Method,Status,Content Type,URL,Load Page. We have an option here which allows users to customize their column views.

Start Tamper - Will initiate the tamper process and record all the HTTP request.

Stop Tamper - Will stop the tampering process as well as recording the HTTP request.

Clear- Will clear all the recorded HTTP request from the window.

Clicking on Start Tamper in this window,will start recording all your ongoing HTTP request  in the window below and it will prompt you for Tamper,Submit,Abort Request of each HTTP request.

Tamper - This allows the users to modify request parameters before request submission.

Submit - This will just send the request without any modification in the request.

Abort Request - This will just stop the request from being sent.

Hitting on tamper button here will open Tamper pop-up showing requested header fields on the left side and the post parameter fields and values on the right side which allows the users to tamper/modify the post parameter values before actually submitting your requests. The only limitation we have here is if the request uses the GET method, then the right-hand side of the dialog will be empty.

"THANKS FOR RUNNING THROUGH MY BLOG. "

KEEP FOLLOWING FOR THE LATEST UPDATES.