• Home
• Topics
• Application and Platform Security
• Open Source Security Tools and Applications
• Zed Attack Proxy tutorial: Uncover Web app vulnerabilities using ZAP

Zed Attack Proxy tutorial: Uncover Web app vulnerabilities using ZAP

Zed Attack Proxy tutorial: Uncover Web app vulnerabilities using ZAP

Date: May 17, 2013

Every year, the Open Web Application Security Project (OWASP) releases a list of the top 10 vulnerabilities found in Web applications. Unfortunately, the list changes little every year because the same Web application flaws show up repeatedly. For companies that are shopping for a Web-based application, this means they must understand the security risks involved with any given Web app, even ones from established vendors. To gain better visibility into a given Web app via penetration testing, enterprises can use OWASP's Zed Attack Proxy (ZAP) tool.

Editor's warning:

Remember to only test or run ZAP scans on websites or Web-based applications your organization controls and obtain written authorization from the site/application manager.

In this SearchSecurity screencast, Keith Barker, a Certified Information Systems Security Professional (CISSP) and trainer for CBT Nuggets, walks viewers through a Zed Attack Proxy tutorial. By using ZAP as a proxy for a Web browser, security pros can listen in on the conversation between PCs and Web servers; ZAP provides a detailed listing of any potential vulnerabilities in a given Web app, including showing the exact code that could be problematic. Even without a browser, ZAP can test the security of a Web app using a "quick start" option that sends out a spider and scans the app. ZAP can be used for both passive scanning, meaning no data is manipulated, and active scanning, meaning that data is manipulated to test the security of an application. And if you're looking to perform something along the lines of a port scan, Keith shows how to find useful add-ons via the ZAP marketplace. ZAP, available for free, is a valuable tool for any organization concerned about the vulnerabilities present in its Web-based applications.

Do you have an idea for a future SearchSecurity screencast? If you have a problem that needs solving or a tool you'd like to learn more about, email us at editor@searchsecurity.com.

 

About CBT Nuggets
CBT Nuggets is a computer-based technology company specializing in cutting-edge online IT training. Founded in 1999 by current CEO Dan Charbonneau, CBT Nuggets provides quick, easy and affordable learning by renowned instructors for individuals, small teams and large organizations. CBT Nuggets also offers free videos on a variety of IT topics on the CBT Nuggets YouTube video channel.

About Keith Barker
Keith Barker, CISSP, is a trainer for CBT Nuggets and has more than 27 years of IT experience. He is a double CCIE and has been named a Cisco Designated VIP. Keith is also the author of numerous Cisco Press books and articles.

More on Open Source Security Tools and Applications

More from Related TechTarget Sites

• Cloud Security
• Consumerization
• Financial Security
• SMB Security
• Security AU
• Security IN
• Computer Weekly

• Cloud Security

  • Storing data in the cloud: Addressing data location security issues

    When storing data in the cloud, ignoring the physical location of cloud data is a major mistake. Learn how to prevent data location security issues.

  • An introduction to enterprise hybrid cloud security

    A custom cloud infrastructure requires a special set of security controls. Get advice on how to implement hybrid cloud security the right way.

  • SOC 2 reports: The de facto cloud provider security standard

    They're not perfect, but SOC 2 reports are becoming the baseline for cloud provider security assessments. Expert Dave Shackleford discusses.

• Consumerization

  • Rich mobile platforms vs. mobile Web-based services

    One big debate right now is whether employees should use local applications or mobile Web-based services. There are use cases for each kind of app.

  • NAC security becoming critical infrastructure component for BYOD

    Organizations are warming up to NAC security products due to popularity of BYOD for robust device security and better systems integration.

  • Managing endpoints is about monitoring access, not device control

    Managing endpoints in the BYOD era isn't easy, and you have to come at it with the right attitude. Focus more on access and less on device control.

• searchFinancialSecurity

  • PayPal CISO: Laws must foster better cybersecurity information sharing

    PayPal's Michael Barrett says many firms fear misuse of shared cybersecurity data. He also discusses the evolution of PCI DSS and mobile payment security.

  • Cybergang plans to use Trojan against U.S. banks

    A cybergang in Eastern Europe revealed plans to attack U.S. banks with a Gozi-like Trojan, according to RSA.

  • Improved Shylock Trojan targets banking users

    The latest variant of the banking Trojan is causing numerous problems, Symantec said.

• searchMidmarketSecurity

  • Windows Phone 7 security: Assessing WP7 security features

    Windows Phone 7 security features are proving to be a mixed bag. Sam Cattle assesses the enterprise security pros and cons of the latest Windows mobile platform.

  • Choosing the best security certifications for your career

    Whether starting your career or planning your next step as an IT security professional, this tip will guide you toward the best certifications for your interests and experience.

  • Midmarket security tutorials

    SearchMidmarketSecurity.com’s tutorials offer IT professionals in-depth lessons and technical advice on the hottest topics in the midmarket IT security industry. Through our tutorials we seek to provide site members with the foundational knowledge needed to deal with the increasingly challenging job of keeping their organizations secure.

• searchSecurityAU

  • Black Hat 2013: Experts urge elliptical curve cryptography adoption

    A session by a team of crypto experts at Black Hat USA 2013 argued that RSA and Diffie-Hellman should be abandoned in favor of ECC.

  • New advanced persistent threat protection: Beyond perimeter defense

    Firewalls and antivirus are ineffective in the face of APT attacks. Expert Nick Lewis offers suggestions for advanced persistent threat protection.

  • Cisco spends cool $2.7 billion in Sourcefire acquisition

    In biggest security acquisition since 2011, Cisco has announced it will buy IDS maker Sourcefire for $2.7 billion.

• Information Security

  • Indian banks step up security amid mobile banking acceleration

    The Indian banking system is at the begining of a new era, driven by mobile technology, but the widening of access to banking services brings with it security risks

  • Web app attacks demand automated defences, study finds

    Automation is the most effective way to tackle multiple prolonged cyber attacks on web applications, a study has confirmed

  • BlackBerry ready to enable India to track messages

    BlackBerry is ready to provide Indian law enforcement authorities with a way to track emails, email attachments and chats sent over its services

• Computer Weekly

  • Government to put 50% of all new IT spend through SMEs

    The government wants to put half of all new IT spending through small IT suppliers – doubling the previous target

  • CIO interview: Mike Timlett, CitySprint

    Mike Timlett's career as an IT director has tracked the rise of mobile technologies that empower new business processes

  • Cisco incubator to connect UK startup clusters

    Cisco is launching its National Virtual Incubator to harness innovation and incubation across the UK.

• About Us
• Contact Us
• Site Index
• Privacy policy
• Advertisers
• Business partners
• Events
• Media kit
• TechTarget Corporate site
• Reprints
• Archive
• Site map