- The document discusses integrating the OWASP ZAP web application security scanner with Selenium automated tests to improve vulnerability coverage during dynamic application security testing (DAST). - It proposes proxying Selenium test traffic through ZAP to perform passive scanning, then triggering an active ZAP scan via API during the continuous integration/deployment pipeline. - Scan reports can be retrieved in various formats and findings imported into a vulnerability management system. A demonstration is provided.

2. • I am Srinivasarao Kotipalli
• Lives in Singapore
• 8 years of experience in Cyber Security
• Authored Hacking Android – Packt Pub
• OSCP & OSCE
whoami

3. • Introduction to automated vulnerability scans and their limitations.
• How functional tests can be useful in performing powerful security tests.
• Introduction to selenium and OWASP ZAP.
• Proxying selenium tests through OWASP ZAP.
• Invoking authenticated active scans using OWASP ZAP.
• Obtaining scan reports.
Agenda

4. OWASP ZAP (short for Zed Attack Proxy)
is an open-source web application
security scanner. It is intended to be
used by both those new to application
security as well as professional
penetration testers.
It can also run in a daemon mode which is
then controlled via a REST API.
Source: https://en.wikipedia.org/wiki/OWASP_ZAP
Introduction to OWASP ZAP

5. • Many commercial tools are available
• Maximum crawling and an active session are crucial for better coverage
• They come with two most important features :
1. An option to record the login sequence
2. Manually explore the Web Application
• Why are these features important?
• DEMO
Automated vulnerability scans

6. • Selenium automates browsers.
• Selenium comes in different flavors and we are specifically talking about Selenium Web Driver.
• Commonly used for automation testing.
• After the product is fully integrated, these tests are run to make sure that the application
is working as expected.
Introduction to Selenium

7. Commit Trigger
Build
Build Test
Server
Run
Tests
Security
Tests
Staging Production
CICD PIPELINE

8. So, what problem are we solving?
• Login Pages in web Applications may stop Automated scanners.
• Features that require authentication may not be properly scanned, with default scans.
• QA teams are already writing scripts to properly crawl through the web apps.
• Security teams may not leverage these QA automation scripts in security testing.

9. So, what problem are we solving?
• knows how to login and crawl through important features.
• knows how to find security issues in crawled pages.
• Login Pages in web Applications may stop Automated scanners.
• Features that require authentication may not be properly scanned, with default scans.
Use them together to achieve better DAST

10. Commit Trigger
Build
Build Test
Server
Run
Tests
Security
Tests
Staging Production
CICD PIPELINE
1

11. Commit Trigger
Build
Build Test
Server
Run
Tests
+
Security
Tests
Staging Production
CICD PIPELINE
2

12. Integrating Selenium and ZAP in CICD pipeline
• Launch ZAP – listens on a port
• Proxy Selenium traffic through ZAP
• Run functional tests (Passive scan is automatically done)
• Invoke ZAP Active scan:
• As a bash command from CI Server
• As a python script on CI Server
• As a test from Selenium
• Get the results:
• As a bash command from CI Server
• As a python script on CI Server
• As a test from Selenium
https://www.zaproxy.org/docs/api/#introduction

13. Proxy proxy = new Proxy();
proxy.setHttpProxy("localhost:8081");
proxy.setSslProxy("localhost:8081");
DesiredCapabilities capabilities = DesiredCapabilities.chrome();
capabilities.setCapability("proxy", proxy);
[Selenium Tests here]
[Optionally, Security Tests here]
Proxying Selenium requests through ZAP
ZAP is run on localhost:8081

14. curl
"http://localhost:8081/JSON/ascan/action/scan/?apikey=<ZAP_API_KEY>&url=<TARGET_URL>&r
ecurse=true&inScopeOnly=&scanPolicyName=&method=&postData=&contextId="
Start ZAP Active Scan from command line
ZAP is run on localhost:8081

15. curl
"http://localhost:8081/JSON/ascan/view/status/?apikey=<ZAP_API_KEY>&scanId=<SCAN_ID>"
Start ZAP Active Scan from command line
ZAP is run on localhost:8081

16. curl "http://localhost:8081/OTHER/core/other/htmlreport/" -o zap.html
curl "http://localhost:8081/OTHER/core/other/jsonreport/" -o zap.json
curl "http://localhost:8081/OTHER/core/other/xmlreport/" -o zap.xml
Get HTML/XML report from command line
ZAP is run on localhost:8081
XML/JSON formats can be useful if you want to import the findings into a Vulnerability Management tool

17. Commit Trigger
Build
Build Test
Server
Run
Tests
Security
Tests
Staging Production
CICD PIPELINE
1
DEMO

18. Commit Trigger
Build
Build Test
Server
Run
Tests
+
Security
Tests
Staging Production
CICD PIPELINE
2
DEMO

19. • You can possibly take advantage of any functional testing framework to perform security scans.
• If you have existing Selenium test cases written for your web apps, use them to drive security scans.
• If you already spent time and efforts on writing Selenium scripts, you already explored the website for
your scanner. Proxy the Selenium traffic through ZAP.
• OWASP ZAP comes with the best and easy to use REST APIs, use them for DAST.
• ZAP is an OWASP project, you can trust its abilities to discover common vulnerabilities.
Key takeaways

20. THANK YOU
Q&A
www.offensivekubernetes.com