The document discusses configuring the Firefox web browser to work with the OWASP Zed Attack Proxy (ZAP) tool in order to conduct quasi-man-in-the-middle attacks against web applications for security testing purposes. It provides instructions for setting ZAP as the proxy in Firefox's network settings and enabling the ZAP plug-in to allow manual testing of vulnerabilities like SQL injection. The results of such security tests run with ZAP are then compiled.

1. Dave Sweigert, CISSP, CISA, PMP, Security+
OWASP (Zed Attack Proxy)
Securing Web Apps with a
quasi-man-in-the-middle (MitM) attack tool
11/25/2014 OWASP Zed Attack Proxy (ZAP) 1

2. Firefox configured to use proxy
11/25/2014 OWASP Zed Attack Proxy (ZAP) 2

3. FireFox Menu -- Tools – Options – Network -- Settings
Set the host to localhost and the port to 8080, these are the
default ZAP proxy ports. Use these settings for all protocols.
11/25/2014 OWASP Zed Attack Proxy (ZAP) 3

4. To enable
FireFox
Plug-in click
Plug-n-Hack
within the
Quick Start
Tab.
11/25/2014 OWASP Zed Attack Proxy (ZAP) 4

5. Configure automatic plug-in within FireFox
11/25/2014 OWASP Zed Attack Proxy (ZAP) 5

6. MANUAL intervention (using a Plug-N-Hack web page in
the FireFox browser) allows manual testing of web
services (e.g. SQL injection, etc.).
These are manual tests typically run by a “human”
penetration tester or software quality assurance (SQA)
tester.
11/25/2014 OWASP Zed Attack Proxy (ZAP) 6

7. Test Results Compiled
11/25/2014 OWASP Zed Attack Proxy (ZAP) 7

8. References:
https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project
11/25/2014 OWASP Zed Attack Proxy (ZAP) 8