Zed Attack Proxy: A Comprehensive Overview of a Powerful Vulnerability Tool

This presentation provides a comprehensive overview of Zed Attack Proxy, a powerful vulnerability tool used in Kali Linux. It covers its features, functioning, and how to install and configure it. The presentation is presented by Desklib and is suitable for anyone interested in learning about vulnerability tools.

Research Security
vulnerability tools using
Kali (Linux)
-Zed Attack Proxy

Presented By-
• Student 1
• Student 2
• Student 3

Overview
• vulnerability tools
• Zed Attack Proxy -Then
• Zed Attack Proxy -Now
• Zed Attack Proxy Principle
• Zed Attack Proxy Principle
• Features of Zed Attack Proxy
• Functioning of Zed Attack Proxy

Research Security vulnerability tools
using Kali (Linux)
• Different type of vulnerability tools are used in kali Linux.
• The list of different type of tools are: Hydra, Maltego, NMap
Zed Attack Proxy, SqlMap, Metasploit Framework, and Burp
Suite.
• In here we will discuss about the Zed Attack Proxy which is
very efficient as a vulnerability tool.

Zed Attack Proxy -Then
• Released Date – September 2010
• Ease of use a priority
• A fork of the well regarded Paros Proxy
• Involvement actively encouraged
• Adopted by OWASP October 2010

Zed Attack Proxy -Now
• Easy to use as a pen-testing tool
• It is a open source tool and free
• This tool is very much helpful for the beginners
• Professionals are also used this software
• Ideal for automated security tests

Zed Attack Proxy Principle
• Opensource
• Free
• Cross platform
• Easy to use
• Fully documented
• Compatible with other tools

Features of Zed Attack Proxy
• The main features of Zed Attack Proxy tool are bellow:
• active and passive scanning
• Traditional and ajax Spiders
• Support for web socket
• Standard security controls
• Mailing Lists
• API
• Dynamic SSL Certificates
• Brute force scanner

More Features of Zed Attack Proxy
• Report generation
• Support different type of scripting like Java, Zest, Python.
• Port Scanning
• Anti CSRF token handlining
• Entreat external applications
• Auto tagging
• Headless mode

Functioning of Zed Attack Proxy
• Reporting
• Intercepting the traffic
• Automated scanning
• Traditional and ajax spiders

Intercepting the Traffic
• Configuring the web browser to using the zap proxy server
on localhost
• This can intercept all the network traffic
• This can click any web link to capture the network traffic
• This request can be modified before forward it to the server
• The result can be intercepting before forwarding it to the
web browser

Spidering
• The Zap spider is required for crawling the invisible links
• Its help to discover the hidden links automatically
• Newly discover links are visible
• The different domain URLs are also listed in the result

Website Scanning
• Two type of scanning mainly done. One is active scanning
and another one is passive scanning
• Active Scanning
• Under the attack section, a site can be select for attack
• Cross site scripting is supported
• Directory browsing is supported
• All result is shown under the alerts tab

Website Scanning
• Two type of scanning mainly done. One is active scanning
and another one is passive scanning
• Passive scanning
• It is different for the active scanning
• Its only looking for the vulnerabilities
• It is safe to use

Analysis and Reporting
• A security analyst can determine the vulnerabilities
• Its has different level of vulnerabilities like High, Low and
Medium.
• The result are analyzed to generate the report
• The report can be exported in to HTML format to view in the
web browser.

Vulnerability Testing

Installing and Configuration
• Download and Install
• https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project
• Configuring the Browser for ZAP proxy
• Importing the OWASP ZAP root CA

Setup Network Proxy

Run Mutillidae website on localhost

Starting the ZAP

Different type of ZAP options

Changing Proxy

Tracking links from Mutillidae website

Spider Attack

Start Scanning

Scanning

Result

Forced Browse Directory

Result

Finding some hidden files

Access to the hidden links

Accessing the hidden file

Conclusion
• Zap is a free open source vulnerability tool to pen testing
• Its helps the users to implement and apply the app security
skills
• Its design is very easy to use
• Increase the security into another level
• Its provide a platform for testing

Bibliography
i. Makino, Yuma, and Vitaly Klyuev. "Evaluation of web vulnerability scanners." Intelligent Data
Acquisition and Advanced Computing Systems: Technology and Applications (IDAACS), 2015 IEEE 8th
International Conference on. Vol. 1. IEEE, 2015.
ii. Sagar, Deepika, et al. "STUDYING OPEN SOURCE VULNERABILITY SCANNERS FOR VULNERABILITIES IN
WEB APPLICATIONS." IIOAB JOURNAL 9.2 (2018): 43-49.
iii. Paudel, Samir. "VULNERABLE WEB APPLICATIONS AND HOW TO AUDIT THEM: Use of OWASP Zed
Attack Proxy effectively to find the vulnerabilities of web applications." (2016).
iv. Anis, Arafa, et al. "Securing web applications with secure coding practices and integrity
verification." 2018 IEEE 16th Intl Conf on Dependable, Autonomic and Secure Computing, 16th Intl
Conf on Pervasive Intelligence and Computing, 4th Intl Conf on Big Data Intelligence and Computing
and Cyber Science and Technology Congress (DASC/PiCom/DataCom/CyberSciTech). IEEE, 2018.
v. Hintea, Diana, et al. "Forensic Analysis of Smartphone Applications for Privacy Leakage." (2016).
vi. Pohl, Christoph, et al. "B. Hive: A zero configuration forms honeypot for productive web
applications." IFIP International Information Security Conference. Springer, Cham, 2015.
vii. Tripathi, Nikhil, and Neminath Hubballi. "Slow rate denial of service attacks against HTTP/2 and
detection." Computers & security 72 (2018): 255-272.