OWASP 2013 EU Tour Amsterdam ZAP Intro

2,389 views

Published on

Slides from my 'Introduction to the OWASP Zed Attack Proxy' presentation as part of the 2013 OWASP EU Tour in Amsterdam.
For more info about ZAP see: https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project

Published in: Technology
0 Comments
3 Likes
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total views
2,389
On SlideShare
0
From Embeds
0
Number of Embeds
5
Actions
Shares
0
Downloads
50
Comments
0
Likes
3
Embeds 0
No embeds

No notes for slide

OWASP 2013 EU Tour Amsterdam ZAP Intro

  1. 1. The OWASP Foundationhttp://www.owasp.orgCopyright © The OWASP FoundationPermission is granted to copy, distribute and/or modify this document under the terms of the OWASP License.OWASP EU Tour2013An Introduction to ZAPOWASPZed Attack ProxySimon BennettsOWASP ZAP Project LeadMozilla Security Teampsiinon@gmail.com
  2. 2. 2What is ZAP?• An easy to use webapp pentest tool• Completely free and open source• An OWASP flagship project• Ideal for beginners• But also used by professionals• Ideal for devs, esp. for automated security tests• Becoming a framework for advanced testing• Not a silver bullet!
  3. 3. 3ZAP Principles• Free, Open source• Involvement actively encouraged• Cross platform• Easy to use• Easy to install• Internationalized• Fully documented• Work well with other tools• Reuse well regarded components
  4. 4. 4Statistics• Released September 2010, fork of Paros• V 2.1.0 released in April 2013• V 2.1.0 downloaded > 10K times• 16 active contributors (Ohloh)• 120 Person years (Ohloh)• Translated into 17 languages• Mostly used by Professional Pentesters?• Paros code: ~30% ZAP Code: ~70%
  5. 5. 5The Main FeaturesAll the essentials for web application testing• Intercepting Proxy• Active and Passive Scanners• Traditional and Ajax Spiders• WebSockets support• Forced Browsing (using OWASP DirBustercode)• Fuzzing (using fuzzdb & OWASP JBroFuzz)• Online Add-ons Marketplace
  6. 6. 6Developer Features• Quick start• REST API• Java and Python clients• Headless mode• Anti CSRF token handling• Authentication support• Auto updating• Modes
  7. 7. 7Some Additional Features• Auto tagging• Port scanner• Script Console• Report generation• Smart card support• Contexts and scope• Session management• Invoke external apps• Dynamic SSL Certificates
  8. 8. How can you use ZAP?• Point and shoot – the Quick Start tab• Proxying via ZAP, and then scanning• Manual pentesting• Automated security regression tests8
  9. 9. 9Regression Testshttp://code.google.com/p/zaproxy/wiki/SecRegTestsSecurity
  10. 10. Ajax Spider via CrawljaxGuifre RuizWebSockets supportRobert KockNew Spider plus Session awarenessCosmin StefanAll in current release (2.1.0)
  11. 11. • Dynamically Configurable ActionsAlessandro Secco• SAML 2.0Pulasthi Mahawithana• Enhanced HTTP Session HandlingCosmin Stefan• Advanced Reporting using BIRTRauf Butt• CMS ScannerAbdelhadi Azouni
  12. 12. But theres more!• Minion – ZAP (+ more) in “the Cloud”Stefan Arentz + others• Plug-n-hack : Easy Browser IntegrationMark Goodwin + Simon Bennetts• Zest – Security scriptingSimon Bennetts + Alessandro Secco• Importing ModSecurity logsJoe Kirwin (Mozilla mentorship)• New networking features(Mozilla intern)
  13. 13. Collaborations• Dradis – ZAP upload plugin• OWASP ModSecurity Core Rule Setscript – SpiderLabs• ThreadFix – Denim Group• Ultimate Obsolete File Detection– Hacktics ASC, Ernst & Young• Grey-box plugin – BCC Risk Advisory13
  14. 14. Any Questions?http://www.owasp.org/index.php/ZAP

×