ZapProxy

ZapProxy Package Description:

ZAP-OWASP Zed Attack Proxy is an easy-to-use integrated penetration testing tool for finding vulnerabilities in web applications. It is a Java interface.

Zed Attack Proxy (ZAP) is a free, open-source penetration testing tool being maintained under the umbrella of the Open Web Application Security Project (OWASP). ZAP is designed specifically for testing web applications and is both flexible and extensible.

At its core, ZAP is what is known as a “man-in-the-middle proxy.” It stands between the tester’s browser and the web application so that it can intercept and inspect messages sent between browser and web application, modify the contents if needed, and then forward those packets on to the destination. It can be used as a stand-alone application, and as a daemon process.

If there is another network proxy already in use, as in many corporate environments, ZAP can be configured to connect to that proxy.

ZAP provides functionality for a range of skill levels – from developers, to testers new to security testing, to security testing specialists. ZAP has versions for each major OS and Docker, so you are not tied to a single OS. Additional functionality is freely available from a variety of add-ons in the ZAP Marketplace, accessible from within the ZAP client.

Because ZAP is open-source, the source code can be examined to see exactly how the functionality is implemented. Anyone can volunteer to work on ZAP, fix bugs, add features, create pull requests to pull fixes into the project, and author add-ons to support specialized situations.

As with most open source projects, donations are welcome to help with costs for the projects. You can find a donate button on the owasp.org page for ZAP at https://owasp.org/www-project-zap/.

Step 1 − To open ZapProxy, go to Applications → 03-Web Application Analysis → ZAP.

Step 2 − Click “Accept”. ZAP will start to load.

Step 3 − Choose one of the Options and click “Start”. Preferably select “No, I do not want to persist this session at this moment in time”

Step 4− Enter URL of the testing web at “URL to attack” → click “Attack”. After the scan is completed, on the top left panel you will see all the crawled sites. In the left panel “Alerts”, you will see all the findings along with the description.

Step 5 − Click “Spider” and you will see all the links scanned.

ZapProxy Usage Example:

root@kali:~# zaproxy