7 Features that make ZAP a great tool for Application Security Testing

The Zed Attack Proxy (ZAP) is an open source tool maintained under Open Web Application Security Project (OWASP) that has a huge community of developers speedily offering new modules or add-ons. The features and capabilities of ZAP has been instrumental  in performing manual penetration tests as well as automated scans here at we45. In this article, I will be throwing some light on some features that make ZAP the go-to tool for any security tester.

AJAX spidering

AJAX spidering is performed during a penetration test to discover requests on an AJAX-rich web application, which cannot be discovered with the regular Spidering tool. The AJAX spidering window can be accessed via  ZAP -> Tools ->AJAX Spider (on ZAP’s menu bar). The tool has configuration parameters such as maximum depth to crawl, maximum crawl states, maximum duration and other options to prevent the possibility of infinite crawling.

Image - An example of AJAX Spider Options

During our penetration tests, we use the regular spidering tool first to identify URLs of the application being tested. Running the AJAX spider after the regular spidering has helped us get a better map of all  application resources in scope. ZAP  gives the option to automatically open the  application  via browser using Selenium and explore the application through an event-driven dynamic crawling engine. This eliminates the need for a manual walkthrough of the application to capture AJAX requests.

A fuzzer is a security tool used to inject a variety of payloads to force the application to go to an undesired state, possibly exposing a potential vulnerability. In ZAP, a tester can choose from a wide range of open source fuzzing payload lists through  sources such as  Dirbuster, FuzzDBand JbroFuzz that  are inbuilt within ZAP making it easier to unearth vulnerabilities than ever before.

 Image - Fuzzer Dialog

A pen-tester can either choose to upload a manual list of payloads or generate payloads by writing his/her own custom scripts . The ZAP  Fuzzer is also highly customisable with controls such as fuzzing location (in the request), number of concurrent threads, delay in fuzzing and  many other options. The fuzzer also has the ability to automatically refresh Anti-CSRF tokens in applications where the tokens regenerate  per  form request. When detecting an Anti-CSRF token, ZAP automatically records the token and the associated URL. ZAP thereby regenerates the token whenever necessary preventing missing/invalid Token errors.

Testing of Websockets is very critical in today’s day and age with its pervasive implementations across applications.. With ZAP, intercepting ,analysing or tampering the websocket traffic between the client and server can’t be any easier!. The websocket Message editor can be accessed via  Tools>>WebSocket Message Editor under the ZAP Menu. The editor can be used to tamper with the Opcodes, Direction, or the message and sent back to the server. ZAP also gives details of the opcode of each message -  Text, Binary, Close, Ping or Pong. The messages can then be filtered based on opcodes or the channels for further scrutiny. The websocket message can also be sent to the fuzzer for subsequent payload injection.

Image - WebSocket Message Editor

For instance, we were once testing a client's visual collaboration platform, which was an application based on websockets. By changing the direction of the message and tampering the parameters in the message via  the message editor, we were able to identify a vulnerability in the application that  resulted in complete denial of service for all users using the interface of the application.

ZAP provides the flexibility to compose a  scan policy based on the requirement of the tester for every  application. The Scan Policy Manager can be found at Analyse>>Scan Policy Manager under the menu bar.

Image - Scan Policy Manager

For a pentester, it is essential to optimize the scanner depending on the ability of the target application to keep up with its  operational performance (and not result in a DoS). It is therefore critical to consider a scanner machine's processing and bandwidth capabilities while designing scan policies.

The scan policy can be altered to include or exclude the kind of test to perform. Definition of parameters such as Threshold - which defines how likely a potential vulnerability would be flagged and the Strength - which defines the number of request for each of the tests can be configured in ZAP.

Many times a pen-tester needs to test scenarios that he/she might encounter frequently across target applications. ZAP allows one to design a custom scan policy, that can be exported as a template. This scan policy can then be imported back into ZAP and re-used.

Interacting With ZAP Programmatically via the REST API

Image - ZAP API UI

This feature has particularly helped us in  integrating some of ZAP’s core  functionality into our Vulnerability Testing Orchestration and Correlation Platform. .

As more and more companies move towards DevSecOps or pursue Agile security testing methods, integrating DAST tools into their CI/CD pipeline manager such as Jenkins is becoming a norm. Having a plugin is essential for  such integrations.

ZAP’s Jenkins Plugin enables integration of security testing within the CI/CD pipeline. Through the  the Jenkins plugin,  we’ve helped our customers integrate ZAP seamlessly into the DevOps pipeline, allowing teams to run automated scans per release. The plugin enables several ZAP operations within the  pipeline such as Spider Scans, AJAX Spidering, Active Scan, Managing  Sessions, Defining Context and correlate results..

A lot of security testing can be automated with scripts, which reduces time spent on manual testing, while giving the tester more time to focus on other important tasks.

ZAP is one of the most extensible/scriptable tools that support any scripting language that allows JSR 223 scripting. ZAP has the feature to run scripts that can be embedded within it to access internal data structures & functionalities through the ZAP Script Add-on. It supports multiple scripting languages which include Javascript, Zest, Python, Groovy and Ruby. The scripts supported include Stand-alone, Active Rules, Proxy Rules etc. We’ve created Zest scripts  using ZAP’s “record scripts” feature to  perform automated walkthroughs of an application, proxy the requests through ZAP, run scans and export the results for subsequent aggregation and correlation.

While these features could be available in other private and publicly available DAST tools, ZAP encapsulates these features (and much more) under a single intuitive and effective open source platform, making it THE Go-To- Tool to perform both manual and automated security scans.