This document discusses automated security testing using the Zed Attack Proxy (ZAP) tool. It describes how ZAP can be used to passively and actively scan web applications for security vulnerabilities by intercepting HTTP traffic. It also provides examples of integrating ZAP into continuous integration builds using its REST API and tasks for Ant and Maven. While automated testing finds many issues, some vulnerabilities still require human intelligence to identify false positives and negatives.

1. Automated Security Testing
Alan Parkinson
@alan_parkinson

2. Disclaimer!
I'm NOT a Security Expert, but a developer passionate
about quality

3. Why the interest in Security?
● New Project - E-commerce
● Compliance
● PCI
● Privacy
● Ethics
● No site is too small to break into
● Security Testing is expensive

4. Security Tools
● Attack Proxies: Sit between the Tester and Application
● Searches for patterns in HTTP traffic
● Help manual penetration testers
● Change values in HTTP traffic
●
3rd Party OnDemand scanning services
● Often for PCI compliance

5. Zed Attack Proxy (ZAP)
● Open Source project forked from Paros Proxy
● Released in 2010 and OWASP top level project
● Easy to use Penetration testing tool – All Skill Levels
● Features:
● Passive scanning of HTTP traffic
● Active scanning of Web Apps
● Spiders, Fuzzing, Brute force and many more....

6. Getting Started with ZAP

7. Beyond Passive Scanning
● Use on Test Environments ONLY
● Active Scanning
● Spider vs Browser
● Real life Browser tests discover RESTful services
● Automated Browser Tests can teach ZAP

8. Converting Browser Tests
Using the ZAP HTTP Proxy
Group test execution based on user roles

10. Integrating ZAP into the build
RESTful API
Ant tasks
Maven Plugin
Session management: New, Save and Open
Tasks: Spider and Active Attack
Results: Ignoring rules and Failing the build

11. False Positives/Negatives
Humans are not out of a job
Some types of Security Vulnerabilities
require Intelligence
CI: Ignoring false positives are parameters to
the Ant tasks

12. Start ZAP
Run Browser
Manual Testing
Tests
Active Scan
Check Save
Results Session
Stop ZAP

13. Build Integration – Stage 1
Nightly Build with Passive and Active
Scanning. The ZAP session is saved for
analysis by a human
Not fast feedback, but accurate results

14. Build Integration – Stage 2
Same Nightly Build with human analysis
Passive scanning in Continuous Build
Fast feedback, but for simple issues only

15. Build Integration – Stage 3
Passive and Active scanning in
Continuous Build
Fast feedback but “Trigger Happy” on rule
exclusion

16. Conclusion
● Additional ROI on your tests
● Great for catching...
● Injection based attacks: XSS and SQL
● HTTP header and Cookie issues
● URL Redirect abuse
● False Positives
● Can be large for some types of tests
● Don't get “Trigger happy” on rule exceptions

17. Automated Security Testing
Alan Parkinson
@alan_parkinson
Demo: https://github.com/aparkinson/jenkins-webdriver
ZAP: http://code.google.com/p/zaproxy/
OWASP: https://www.owasp.org
Ant Demo:
https://code.google.com/p/zaproxy/source/browse/trunk/build/build-api.xml