Welcome to Part Five of this module
the O WASP Z attack.
Proxy also known as zap is a popular free security tool that is actively maintained by volunteers.
It comes prepackaged with Kali 2.0 and is entirely open source.
It is designed to help you find security vulnerabilities in your web applications while you are developing
and testing those applications.
It is a solid tool for experienced pen testers to use for manual security testing.
It's also very simplified for beginners.
Oh WASP zap can be found under applications.
Web application analysis.
Oh WASP because this tool takes rather a long time to load.
I've gone ahead and started it already.
The first time you launch the program you will be prompted to agree to a user agreement and there is
no other special configuration required.
Just be aware that it doesn't tend to load very quick.
Zap is cross platform so it can be used on Windows Linux and Macs.
It is entirely free and open source.
As I said so unlike burps sweep there is no licensed edition zap does require java to run.
This video is intended to be a very generalized overview of Zap and what it can do for you right away.
You probably notice that this tool bears a striking resemblance to burps sweet and that is no accident.
Zap performs many of the same functions as burps sweet at least the community addition although it has
fewer tabs and features that isn't to suggest that this tool isn't worth your time.
In fact it works at least as well as burp in terms of the areas of its functionality.
But if you've been working with burp sweet for a while now you weren't likely to see anything here that
will jump out at you is new and exciting.
Fewer options means that this tool is simpler to use than burp sweet but you don't have the ability
to do things like control the linked depth of your spider ring or send results to the intruder for brute
force hacking I try not to express too much opinion in these presentations but I have to state that
this makes zap the inferior offering out of the box because once you get used to having full control
and burp it's hard to deal with issues such as for example the spider ing process going on forever because
the length depth is simply out of control.
Now you can expand the functionality of Zap which I'll talk about a little bit later.
There are many different plugins and add ons that can be included.
What you're seeing here is just what comes prepackaged with Carly Linux.
That being said having the ability to generate reports with this tool in various formats for free is
pretty nice and can make for some very pretty presentations after a penetration test.
And that isn't something you can really do with burps sweet community additions ease of use was a priority
of the developers who created zap which makes it very simple for beginners to demonstrate its use.
I will be attacking a Met split able to machine that I have running in the background for more details
about how to setup this machine.
Please see the prior modules as always.
Never use this program against any target that you do not personally own or have written permission
to pen test.
One other small addendum to note I'm going to assume that you have watched the prior videos in this
module covering the burp suite community additions so I will not be explaining the theory behind these
processes all over again.
Please see the prior video on spider ring in burp suite.
If you have any questions about these processes that this video doesn't answer by itself.
Alright so as I said zap is very easy to use.
You just enter the Web you are all of the target.
That of course you have permission to test against and click the attack button.
In this case we'll be using the IP of our met a spoiler tool box which for me is 10 0 0 8.
Now I will quickly point out that our target is going to be motility.
This is a vulnerable Web application a that is hosted on met exploited all to so it is a very convenient
target.
If you've been watching other videos you will have seen me do this already.
I'm going to narrow our target by copying motility
and I'm going to put in slash and guess it won't let me paste it so until day
if I simply scanned 10 dot 0.01 8.
It would scan the entire met a spoil machine which is running several different vulnerable Web applications
so that would take a very long time.
By narrowing down the motility we'll just get a select few results.
And now we click the attack button.
Right away we can see that the requests are already piling up in the spider ring tab.
This will take a few minutes and I may make small cuts to this recording in order to save time.
As I expressed at the start of this video there is no way in the prepackaged edition to control the
length depth of the spider ring process so that can make this a rather lengthy procedure and now we
can see that it has added an active scan tab
and forgive me.
The system is going to be slow.
This is being done inside a virtual box and again the length depth doesn't just apply to the spider
it also applies to the active scan.
There are ways to limit this but this is basically automated scanning to look for attack vectors.
Very straightforward and very powerful although it would also be very obvious to anyone looking at logs.
This is very useful because it allows you to spot vulnerabilities and test them out with other tools
or even your own web browser against the target.
What you are seeing now is in fact running a whole lot of active scanning and if we just let it go it
could take hours.
You can see the progress bar is progressing with painful slowness.
All of these items are being checked against a database of vulnerabilities
over here.
You can see that we have been spider ing all through the site getting all of the information that we
might require in order to get into the site itself in the alerts tab.
We can see what potentially exploitable problems have been found.
So when you look over here you can see what sort of information you can get off the web server there.
These are sorted into terms of priority and assigned to flag the red flag.
So the ones that are most interesting because they are deemed high risk.
Those are your best bet for things to attack against a description of the weakness is included and you
can expand the target to see individual get requests
so we can see that this risk is assessed as being high confidence medium if we scroll down here again
forgive the slowness we can get a more detailed explanation of the threat
and you get the idea that being said while this may seem like a very easy way to generate a laundry
list of exploitable attacks against a target web application.
Be aware that you may need to confirm some of these with additional tools zap sometimes gives false
positives that won't be the case here with Metis Floyd label.
But it is something to think about and that is indicated by the confidence level right here if you have
a web application server it is advisable to run this tool against your own site and then look online
to see what these warnings mean.
If the description is not clear enough through this method it's possible to find sites that are vulnerable
to things like S Q Well injection and brute forcing another thing that we can do is highlight the Web
you are El
in these requests copy them
and then paste them into our web browser
and this can give us more information about a particular result and how it might be hacked.
Sometimes this information is useful.
Sometimes it isn't and of course you do have to know what you're looking at.
So hopefully this gives you an idea of what this tool does and how to use it as you can see the scans
are still running and if I had not narrowed the target to just multiple a day the spider in process
would have been virtually endless as a system administrator.
This tool allows you to find ways to harden your security from the black hat side of things.
It allows a bad actor to find ways to attack seemingly well protected servers with enterprise firewalls.
By learning how best to encode and encrypt their attacks it also helps an attacker to know how to avoid
tripping any host intrusion detection systems that may be in place then advanced their attack more smoothly.
It is also worth pointing out that this application has many plugins and add ons available for it.
It is made to be an expandable framework so while you may not see a brute forcing tab or anything equivalent
to burp suite intruder in the prepackaged version it is possible to download plugins and add ons to
grant zap that sort of functionality zap is also unique in that it has excellent smart card support.
So if the app you are testing uses tokens or smart cards for authentication that's something to consider
zap also has the capability to compare two sessions which is very useful if your application supports
multiple roles and this is not possible with the burps suite community edition.
It can even invoke external apps where supported and you can import results back in this app which is
pretty handy and again not something you can do in the community edition of burps sweet.
So to conclude this presentation I'll just say that while SAP is rather simplistic out of the box users
who do not wish to purchase the burp sweet commercial Edition may find zap to be an acceptable substitution
once additional plugins and add ons are installed.
However always do your due diligence and never download a plug in or an add on from an untrustworthy
source without first verifying it.
Finally it is possible to configure your browser to proxy via his app in exactly the same way as you
would with burp suite.
For more information on how to do this please see the prior module.
Be aware that you can only use one such program at a time so you can't do this with both burps sweet
and zap simultaneously and that about covers it.
This is a very simple application although quite powerful.
I hope you find it useful in your penetration testing thank you.