Every year, the Open Web Application Security Project (OWASP) releases a list of the top 10 vulnerabilities found in Web applications. Unfortunately, the list changes little every year because the same Web application flaws show up repeatedly. For companies that are shopping for a Web-based application, this means they must understand the security risks involved with any given Web app, even ones from established vendors. To gain better visibility into a given Web app via penetration testing, enterprises can use OWASP's Zed Attack Proxy (ZAP) tool.
Remember to only test or run ZAP scans on websites or Web-based applications your organization controls and obtain written authorization from the site/application manager.
In this SearchSecurity screencast, Keith Barker, a Certified Information Systems Security Professional (CISSP) and trainer for CBT Nuggets, walks viewers through a Zed Attack Proxy tutorial. By using ZAP as a proxy for a Web browser, security pros can listen in on the conversation between PCs and Web servers; ZAP provides a detailed listing of any potential vulnerabilities in a given Web app, including showing the exact code that could be problematic. Even without a browser, ZAP can test the security of a Web app using a "quick start" option that sends out a spider and scans the app. ZAP can be used for both passive scanning, meaning no data is manipulated, and active scanning, meaning that data is manipulated to test the security of an application. And if you're looking to perform something along the lines of a port scan, Keith shows how to find useful add-ons via the ZAP marketplace. ZAP, available for free, is a valuable tool for any organization concerned about the vulnerabilities present in its Web-based applications.
Do you have an idea for a future SearchSecurity screencast? If you have a problem that needs solving or a tool you'd like to learn more about, email us at firstname.lastname@example.org.
About CBT Nuggets
CBT Nuggets is a computer-based technology company specializing in cutting-edge online IT training. Founded in 1999 by current CEO Dan Charbonneau, CBT Nuggets provides quick, easy and affordable learning by renowned instructors for individuals, small teams and large organizations. CBT Nuggets also offers free videos on a variety of IT topics on the CBT Nuggets YouTube video channel.
About Keith Barker
Keith Barker, CISSP, is a trainer for CBT Nuggets and has more than 27 years of IT experience. He is a double CCIE and has been named a Cisco Designated VIP. Keith is also the author of numerous Cisco Press books and articles.