Zed Attack Proxy is an open source security software written in Java programming language and released in 2010. It is used to scan web applications and find vulnerabilities in it. It was started as a small project by Open Web Application Security Project (OWASP) and now it is the most active project maintained by thousands of individuals around the globe. It is available for Linux, Windows and mac in 29 languages. It can also be used as a proxy server like burp suit to manipulate the request including the https request. Daemon mode is also present in it which can later controlled by REST API.
- Passive Scanner
- Automated Scanner
- Proxy Server
- Port Identification
- Directory Searching
- Brute Force Attack
- Web Crawler
Why we use Zed Attack Proxy?
Zed Attack Proxy is used to detect vulnerability present on any web server and try to remove them. Here are some big vulnerability that could be present in the web server:
- SQL injection
- Cross-site scripting (XSS)
- Broken access control
- Security miss-configuration
- Broken authentication
- Sensitive data exposure
- Cross-site request forgery (CSRF)
- Using components with known vulnerabilities.
Some Important Terminologies:
- Proxy Server: It is a server which act as a mediator for clients who want to go through the request and want to alter them.
- Spider: It is a type of information gathering process in which the application in this case ZAP will go through the whole web page and try to find out all the links and other important details.
- Passive Scan: In this type of scanning the vulnerability is detected without getting in direct contact with the target machine.
- Active Scan: In this, the vulnerability is detected by getting in direct contact with the target machine which makes is very easy to be detected by the administrator.
Working Process: First we setup the proxy server with any browser. The browser sends website data to the proxy server and then the browser inside the ZAP process the request and perform attacks and generates the report.
- Step 1: Download ZAP from https://www.zaproxy.org/download/ by selecting proper operating system.
- Step 2: Run the file and follow the instruction until the installation is complete.
Steps to Run:
- Step 1: Open the application through terminal or by clicking on icon.
- Step 2: In the next step, select the first option and click start.
- Step 3: Now choose a target to scan and enter its web address in the green highlighted box and click attack.
- Step 4: Now you will have to wait for few minutes to get the result.