More Power to ZAP

Transcript

1. Gowtham Sundar More Power to “ZAP”
2. About Me! Lead Security Engineer @ Freshworks • ZAP Evangelist • Interested in Offensive Security • Blogger and active Learner Blog - medium.com/@gowsundar 2
3. Session Agenda • ZAP - Introduction • Explore ZAP Features • ZAP Power Up’s ◦ ZAP Marketplace - Overview ◦ Demystifying Add-ons ◦ Quick Demo’s 3
4. Takeaways • Know / Understand ZAP features • Utilize ZAP addons for effective coverage / pen-test • Importance of contribution to open-source • Identify bugs for $$$ free using ZAP !!! 4
5. Let’s Dive In!! 5
6. OWASP ZAP - Introduction • Widely used Web Application Proxy • An OWASP Flagship Project • Free and Open Source • Well Maintained • Highly Flexible • Powerful Automation Framework 6
7. The Problem • Need to spend $$$ / buy pro version to utilize full features • Cost / User / License Management 7
8. The Solution Avoid Cracked / Pirated Softwares Spend $$$ to unlock features [Paid Softwares] Use open-source / community powered tools OR Use both [Paid+Open Source] based on requirements 8
9. Before We Begin!! Credits: - Simon Bennetts (@psiinon) - ZAP Dev / Core Team Members - ZAP Contributors 9
10. • Active Scan ◦ Attack Mode ◦ Disabled by default ◦ Multi-threading support • Passive Scan ◦ Non-Intrusive ◦ Enabled by default ◦ Custom rules via scripts • Customized scan Policies • Alpha / Beta rules via add-ons 1.Automated Scanner 10
11. #ZAPTips Use “AddZapHeader.js” script to add custom header in all requests to identify ZAP traffic and avoid getting blocked by WAF !! #ZAPTips 11
12. • Spider - identify URLs of the website • AJAX Spider ◦ Browser driven coverage ◦ Like Manual Navigation of Website ◦ Controlled Configuration • Option to export results as CSV 2.Web Crawler Combine AJAX Spider with normal spider to discover additional endpoints. #ZAPTips 12
13. Community Scripts Reference - https://github.com/zaproxy/community-scripts 13
14. But Wait !!! 14
15. Alpha / Beta Rules Reference - www.zaproxy.org/blog/2021-12-14-log4shell-detection-with-zap/ 15
16. Fuzzer - Random data / payloads - “Manual” fuzzing - Payload / Message processors - FuzzDB / FuzzDB Offensive / SVN Digger Files [Add-on] Content Discovery - Files / Directories - Force browse - OWASP DirBuster fork - Actively maintained 2.Fuzzing / Content Discovery 16
17. - Race Conditions - Cross Site Scripting (XSS) - SQL Injection - Brute Force Attacks - Many others with custom payloads / scripts Vulnerability Coverage 17
18. #ZAPTips You can “edit” the message / request you fuzz via the fuzzer dialog. #ZAPTips 18
19. Quick Demo - Race Condition Application Credits - OWASP TimeGap Theory Project by Abhi M Balakrishnan 19
20. Quick Demo - File / Directory Enumeration 20
21. 4.ZAP API • Programmatic Interaction with ZAP • Available in JSON, HTML and XML formats • API Scan script available in ZAP Docker image • OpenAPI and SOAP support via Add-on • Provides base for various automation in CI / CD 21
22. Quick Demo - ZAP API 22
23. The PowerUP’S - ZAP Addons 23
24. ZAP Marketplace - Overview Reference - https://www.zaproxy.org/addons/ 24
25. ZAP Add-ons - Explained • Provides additional support • Full access of ZAP internals • Add-on statuses - Alpha -> Under development - Beta -> To be tested - Release -> High quality / ready to use • Custom Add-on support You can add/remove add-ons from ZAP UI with “no restart” required. #ZAPTips 25
26. ZAP Add-ons - Explained Add-ons Distribution Status No.of Add-ons* Alpha 38 Beta 27 Release 20 Total ~85 *Excluding help / translation files Reference - www.zaproxy.org/addons/ 26
27. PowerUP 1 - OAST OAST - Out-of-band Application Security Testing • Detect / Exploit Blind Vulnerabilities • No response even the attack is successful • Supported Services - BOAST - In built callback server - Interactsh by Project Discovery Image credits - https://ricekot.com/2021/levelling-up-zap-with-oast/ 27
28. Vulnerability Coverage - Server Side Request Forgery (SSRF) - Out-of-band (OOB) XML-External -Entity Injection(XXE) - Blind Cross Site Scripting - Bling SQL Injection - Other External Service Interactions 28
29. Quick Demo - SSRF Detection 29
30. #ZAPTips 30 OAST Indicators: Service Not Registered Service Registered and being polled. Service registered as Active Scan Service. #ZAPTips
31. PowerUP 2 - Automation Framework Automation Framework • Replacement for Command Line / Packaged Scan options • Easy and flexible Automation • Controlled via Single YAML File • Customized • Job based actions 31
32. Quick Demo - Automation Framework 32 The automation framework supports all type of authentication supported by ZAP. #ZAPTips
33. PowerUP 3 - Websockets WebSockets - • Intercept / Fuzz WebSocket messages • Breakpoints on specific types of WebSocket messages • Scan WebSockets Passively • Custom Scripts for websockets 33
34. Quick Demo - Websockets 34 Use the Cross Site Website Hijacking.js script rule to detect/validate XSWH attacks. #ZAPTips
35. Bonus 35
36. Retire.js • Used to detect vulnerable and outdated javascript libraries • It is included as part of passive scan rules. 36
37. Wappalyzer • Used to detect technologies used by the application • Uses Regex pattern for detection • Can be Enabled / Disabled • Results can be exported as CSV 37
38. Diff / Comparer • Used to compare 2 requests / responses • Invoked by selecting requests / responses • Accessed via right click menu dialog • “Beta” addon 38
39. Encode/Decode/Hash • Used to Encode/Decode/Hash a test/string • Option to add / remove custom tab and output panels • Supports various encode / decode / hash options like “base64”, “URL”, “SHA256”, many.. 39
40. Generate CSRF Test Form • Used for testing Cross Site Request Forgery Vulnerabilities • Create easy CSRF PoC file 40
41. Want to see something cool ? 41
42. ZAP HUD 42 • HUD (Heads Up Display) • ZAP Features directly in browser • Easy configuration • Works in Desktop and Daemon mode
43. Run ZAP Without Java ?? 43 • Docker + Webswing = ZAP in browser • Useful during diagnosing • Avoid Installation overheads Reference - https://www.zaproxy.org/blog/2021-02-03-run-zap-without-java-using-docker-and-webswing/
44. Quick Demo - ZAP Webswing 44
45. Conclusion 45 That’s all ?? ZAP has much more…
46. References / Resources 46 • Extensive Documentation - https://www.zaproxy.org/docs/ • https://www.zaproxy.org/docs/guides/zapping-the-top-10-2021/ • https://www.zaproxy.org/addons/ • https://manosmagnus.github.io/posts/websocket-passive-scan-using-scripts- with-zap/ • https://github.com/zaproxy/community-scripts • https://www.zaproxy.org/videos/
47. Thank you for watching! Linkedin: @gowtham-sundar-6669b380/ Twitter: @gowsundar 47