[Day 9] 3. ZAP (Zed Attacking Proxy)

DAST (Dynamic Application Security Testing)

• What is it?

  • DAST tests live web applications dynamically by simulating attacks on them.
  • It focuses on finding runtime vulnerabilities like XSS, SQL Injection, etc., in live environments.

• Example Tool: ZAP (OWASP Zed Attack Proxy)

  • Commands for Kali Linux:

    bashCopy
    which zap
    sudo apt install zaproxy
    sudo zaproxy
    

    • Select No when asked to persist the session.
    • Update everything if time permits.
    • For Firefox users: Copy the URL from the browser and paste it in the Automated Scan Panel.
    • Use the Traditional Spider option and keep it active.
    • Press Attack to start the scan.
    • Vulnerabilities will be listed after the scan, along with a Risk vs. Confidence Chart.
    • Generate a ZAP Scanning Report after completing the scan.

  ⚠️ Important: Perform scans only on websites where you have explicit permission to do so. Logs can be used against you otherwise.

• Burp Suite (Professional Version):

  • Steps:
    1. Open Burp Suite and select New Scan.
    2. Choose Crawl and Audit.
    3. Enter the website URL.
    4. Choose the scan type: Lightweight, Fast, Balanced, or Deep.
    5. Press Scan to begin.

SAST (Static Application Security Testing)

• What is it?
  • SAST analyzes application source code or binaries to detect vulnerabilities.
  • It's used during the development phase to catch issues early before deployment.

Comparison of SAST and DAST

|Feature|SAST|DAST| |---|---|---| |Phase|Development phase.|Post-deployment or in live environments.| |Analysis|Static (source code or binaries).|Dynamic (running applications).| |Type of Vulnerability|Detects logic or design flaws.|Detects runtime vulnerabilities.| |Tools|SonarQube, Checkmarx.|ZAP, Burp Suite.|

Open Source Tools

• Check out the OWASP Source Code Analysis Tools for additional resources.