Alright.
Welcome back.
Today we are going to use the tool OAuth zap or Zap proxy.
I'm going to open up terminal because Kali Linux does not have this tool already installed.
We actually need to install it.
So we're going to type in sudo and then app apt install and then zap proxy.
Just like that only one p only one t.
Then we're going to hit that button.
So it asked me for my password.
Let that sucker go into play and let it do its thing.
So this will take a minute to get installed.
Depending on how fast or slow your machine is, it could take a few minutes.
All right.
Once it's in there, we're actually going to start it.
And to start it we type in OWASp, OWASp, Dash, zap.
And let's do that switch H or that tag H to get that help menu.
And you can see that it's going to go through and identify whether or not it's working or not It's also
going to give this manual for us.
And we can see the little captions right here and all this other good stuff.
Now zap, a nice, really nice thing about it is it actually has a GUI interface.
So to use that gooey interface we're just going to type in OWASp Dash zap.
And it's going to boot up for us.
Now the first time it boots up it's going to take a few minutes because it's going to download some
stuff and it says do I want to do the persistence?
Do I not want to do the persistence?
What do I want to do?
I'm going to say, no, I don't want to persistent session at this time, uh, I'm not going to remember
my choice.
I'm going to go ahead and press start.
Let me blow this up so you can see it.
And it's going to ask me, do I want to update all these items?
I recommend you update everything.
I'm just weird like that.
I like updated software.
I know it's weird, right?
And again, let me blow this up and then I can also press this update all button if I wanted to.
I'm just going to update the selected because those are the ones that need an update, and it's going
to say yes and let it do its thing.
This again will take it a second to get up there, and you'll start to notice that everything has been
updated except for this one right here.
But for the interest of time, I'm just going to close that out.
Let's re do that.
And here we go.
Let's get started.
Using this tool we're going to do an automated scan.
And it's going to ask me what the URL is.
Now I'm going to use again chapter two, and I'm just going to type in that IP address right there.
Okay.
Once I'm done with that I have some choices.
I can do Firefox, headless Chrome, so on and so forth.
I'm going to just use the default for purposes of exercise today.
And then I'm going to hit that little attack button right there and let it do its thing.
Now it's going to go through and it's going to start scanning.
While it's scanning I want to point out some things to you.
There's the alerts button right here.
This alerts tell us all the vulnerabilities that it's found so far.
It also has its output of different items that it's outputted based on what you've done in the past.
It is a spider.
The spider is going through the web server, and it's looking for active directories that it can find.
And then it has this active scan which again goes through it.
I'm going to go to alerts.
I'm just going to start with this red flag.
That's the most critical the SQL injections two.
I can press that little down arrow and I can click on a specific one if I wanted to.
And it's saying hey index.php risk of high confidence medium parameter.
It's using a SQL injection.
So if it did zap or one equals one that's the attack it utilized.
It has the ID of 89 and it's saying SQL injection may be possible.
May be possible.
If I scroll down a little bit over here it's saying other information.
The page results were successfully manipulated using Boolean and it says solution.
Do not trust this site input even if the client site is validated in place.
In general type all data.
Yada yada yada.
And it gives me a reference to look at.
So it's telling me what I need to do in order to provide a decent solution.
Now, is the solution the best case?
Probably not.
Right.
The best solution would go in there and do input validation.
Uh, and make sure that the developers go through and make sure that the, the program or the software
is not vulnerable to input attack or SQL attack.
Right?
So whoever developed the website, we would want them to go through and do that process.
Right.
So this is very quick, very down and dirty.
This is OWASp very, very easy to use.
Uh, I like the GUI interface.
This is actually one of the programs that I truly enjoy because it makes it so simple to use.
All right.
I hope you learned something.
As always, have a good one.