🛠 Security Tool Cheatsheet
Daniel Osei — Security Tools Architect
What is OWASP ZAP?
The OWASP Zed Attack Proxy (ZAP) is a popular open-source web application security scanner that helps in finding security vulnerabilities in web applications during development and testing. It is widely used by developers and security analysts for penetration testing and vulnerability assessments.
Installation
To install OWASP ZAP, you can download it from the official OWASP website or use package managers. Below are methods for different platforms:
- Windows: Download the installer from OWASP ZAP Downloads.
- Linux: Use the command:
sudo apt install zap - macOS: Install via Homebrew:
brew install owasp-zap
Basic Syntax
The syntax for running ZAP from the command line is as follows:
zap.sh [options] [target]
Discovery
Spidering a Website
To perform spidering (crawling the website), use:
zap.sh -cmd -quickurl [TARGET_URL] -quickout [OUTPUT_FILE]
This will spider the target URL and save the output in the specified file.
Scanning
Active Scan
To initiate an active scan on a specific URL, use:
zap.sh -cmd -scan [TARGET_URL]
Passive Scan
To perform a passive scan on the current context:
zap.sh -cmd -passive
Exploitation
Running SQL Injection Tests
To test for SQL injection vulnerabilities, you can use:
zap.sh -cmd -scan [TARGET_URL] -risk [1-3] -query [SQL_INJECTION_PAYLOAD]
Analysis
Generate a Report
To generate a report after scans, use:
zap.sh -report -o [OUTPUT_REPORT] -f HTML
Evasion
Change User-Agent
To avoid detection during testing, you may want to change the User-Agent:
zap.sh -useragent [NEW_USER_AGENT]
Reporting
Customizing Report Formats
OWASP ZAP can generate multiple report formats. To specify a format, append the format option as follows:
zap.sh -report -o [OUTPUT_REPORT] -f [REPORT_FORMAT]
Quick Reference Table
| Flag | Description |
|---|---|
| -cmd | Run in command mode |
| -quickurl | URL to scan quickly |
| -scan | Initiate an active scan on the target |
| -report | Generate a report |
| -useragent | Change user agent |
Pro Tips
- Use the Session Management capabilities to keep track of multiple scans.
- Enable WebSocket support to find vulnerabilities over WebSocket communications.
- Integrate ZAP with CI/CD pipelines for automated testing.
Real-World Examples
Here are a few examples from the field:
- Example 1: A client had multiple SQL injection points found using the command
zap.sh -cmd -scan http://example.com/login -risk 3which automatically tested for higher severity vulnerabilities. - Example 2: Generating a report after scanning to share findings with the development team goals:
zap.sh -report -f CSV