Hack Like a Pro: How to Hack Web Apps, Part 6 (Using OWASP ZAP to Find Vulnerabilities) « Null Byte :: WonderHowTo

Welcome back, my tenderfoot hackers!Web appsare often the best vector to an organization's server/database, an entry point to their entire internal network. By definition, the web app is designed to take an input from the user and send that input back to the server or database. In this way, the attacker can send their malicious input back to the servers and network if the web app is not properly secured.OWASPis the Open Web Application Security Project, a vendor-neutral, non-profit group of volunteers dedicated to making web apps more secure. As such, they publish theirOWASP Top 10to showcase the most critical vulnerabilities, and have designedWebGoat, a deliberately vulnerable web application for teaching and testing web app security. As part of this effort, they have also developed theOWASP Zed Attack Proxy(ZAP) tool.OWASP ZAP is a Java-based tool for testing web app security. It has an intuitive GUI and powerful features to do such things as fuzzing, scripting, spidering, proxying and attacking web apps. It is also extensible through a number of plugins. In this way, it is an all-in-one web app testing tool. OWASP ZAP might even become your go-to web app testing tool once you get the hang of it.In this tutorial, we will take a look at this powerful and versatile tool.Step 1: Fire Up KaliLet's begin in the usual way—by firing upKali. In this tutorial, I will be using Kali 2.0 as so many of you are now using it, although I still have my reservations. Earlier versions of Kali also have OWASP ZAP, so if you are using those, you can also follow this tutorial.Step 2: Start OWASP ZAPIf you want to start OWASP ZAP from the command line, you can simply type:kali > owasp-zapThis should start the application as seen below. It's slow, so be patient.For those who prefer the GUI approach, go to Applications -> Web Application Analysis -> owasp-zap. Again, be patient, as it will take awhile to load the tool.The first thing you will see is the license. Go ahead and accept the terms if you feel comfortable with them. This is a standard Apache license.Step 3: The OWASP ZAP InterfaceWhen OWASP ZAP eventually opens, it should look like the screenshot below. This tool has many powerful features, but initially, we will only try out its "Attack" function in the large right-hand window. In this mode, OWASP ZAP aggressively goes to the website we designate and begins to look for vulnerabilities.Step 4: Attacking a WebsiteIn this first tutorial, let's test a website initially left vulnerable and safe to test,webscantest.com. Put the URL in the space next to "URL to attack" and then simply click on the "Attack" button below it.OWASP ZAP will now begin to spider and test the web application for numerous vulnerabilities.Step 5: Attack Results & AlertsWhen it has completed its work (this can be considerable time for large websites), you should see a screen like that below.As you can see in the lower left window, OWASP ZAP has sent us 8 alerts. These alerts are categorized by the type of vulnerability. In this case, these are:Cross Site ScriptingRemote OS Command InjectionDirectory BrowsingX-Frame-Options Header Not SetCookie set without HttpOnly flagPassword Autocomplete in browserWeb Browser XSS Protection Not EnabledX-Content-Type-Options Header MissingNext to each category of alert is a number that represents the number of occurrences of that type of vulnerability. If you click on the arrow next to the alert, it will expand to show you each occurrence of the vulnerability.In the screenshot above, I first clicked on the alert "Cross Site Scripting" and it opened a window with information on it to the right reflecting the application's assessment of the risk (High) and confidence (Medium). Then, I expanded the alert to show each of the XSS vulnerabilities in this web app.The next step, of course, is to test each of the reported vulnerabilities to see whether they are real.Step 6: Install the Proxy into FirefoxFor ease of use, we can install the "Plug-n-Hack" extension in Firefox 24 or later browsers (Iceweasel, the default browser in Kali, is a fork of the Mozilla Firefox project). From the Quick Start menu, you can see the "Plug-n-Hack" button. Simply click on it to install the extension into your browser.Iceweasel will open with the following screen. Go ahead and select "Click to setup!"You will get a warning like that below; go ahead and click "Allow."Finally, go ahead and install the add-on to your browser.Now, you can just use your browser and whatever website you are visiting will be automatically available to the OWASP ZAP application.Infuture tutorials, we will further explore the capabilities of this powerful web app testing application, so keep coming back my tenderfoot hackers!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHow To:Abuse Session Management with OWASP ZAPHow To:Beginner's Guide to OWASP Juice Shop, Your Practice Hacking Grounds for the 10 Most Common Web App VulnerabilitiesHack Like a Pro:How to Hack Web Apps, Part 2 (Website Spidering with WebScarab)Hack Like a Pro:How to Hack Web Apps, Part 1 (Getting Started)News:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:How to Hack Web Apps, Part 5 (Finding Vulnerable WordPress Websites)Hack Like a Pro:How to Find Website Vulnerabilities Using WiktoHack Like a Pro:Using the Nmap Scripting Engine (NSE) for ReconnaissanceHow To:Hack web browsers with BeEFHack Like a Pro:Hacking Windows XP Through Windows 8 Using Adobe Flash PlayerHack Like a Pro:Using Nexpose to Scan for Network & System VulnerabilitiesHack Like a Pro:How to Scan the Internet for Heartbleed VulnerabilitiesHack Like a Pro:How to Find the Latest Exploits and Vulnerabilities—Directly from MicrosoftHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHow To:Expand Your Coding Skill Set with This 10-Course Training BundleAndroid for Hackers:How to Scan Websites for Vulnerabilities Using an Android Phone Without RootWhite Hat Hacking:Hack the Pentagon?How To:The Art of 0-Day Vulnerabilities, Part 1: STATIC ANALYSISHack Like a Pro:How to Exploit Adobe Flash with a Corrupted Movie File to Hack Windows 7How To:Hack websites using cross-site scripting (XSS)Hack Like a Pro:How to Hack Web Apps, Part 7 (Finding Hidden Objects with DIRB)Hack Like a Pro:How to Use Hacking Team's Adobe Flash ExploitHIOB:WebSite Hacking Series Part 2: Hacking WebSites Using The DotNetNuke VulnerabilityHow To:Break into the Lucrative World of Ethical Hacking with This Reasonably Priced Course BundleHow To:Leverage a Directory Traversal Vulnerability into Code ExecutionHow To:Top 10 Exploit Databases for Finding VulnerabilitiesNews:iOS 11.1 Is Officially Out, Includes New Emojis, App Switching Gesture & MoreHack Like a Pro:How to Find Almost Every Known Vulnerability & Exploit Out ThereHow To:Learn to Code Your Own Games with This Hands-on BundleHow To:Hack Apache Tomcat via Malicious WAR File UploadHow To:The Art of 0-Day Vulnerabilities, Part3: Command Injection and CSRF VulnerabilitiesHow To:Fix Your Hacked and Malware-Infested Website with GoogleNews:Flaw in Facebook & Google Allows Phishing, Spam & MoreHow To:The Official Google+ Insider's Guide IndexHow To:Spider Web Pages with Nmap for SQLi VulnerabilitiesHow To:Hack Coin-Operated Laudromat Machines for Free Wash & Dry CyclesHow To:Hack Anyone's Facebook, Twitter or YouTube Account with Your Android DeviceHow To:Is Your Website Vulnerable to XSS Injections? Here's How to Protect Your VisitorsNews:Half a Million Macs Affected by Flashback Trojan! Eradicate It Before It's Too LateHow To:Hack websites with SQL injection and WebGoat