Security Automation With OWASP ZAP - ZAPCon 2021

Presentation of my talk at ZAPCon 2021 - After Hours.

Watch the recording here - https://www.youtube.com/watch?v=hLNLBcY0L-M

Video Reference 1 - https://drive.google.com/file/d/1wm5veaZJwe50xZJ68tHpKcrPvuepQnT3/view?usp=sharing

Video Reference 2 - https://drive.google.com/file/d/1nBuiolD4GWHNQWNgLNLFPZ6T2Rmswoi_/view?usp=sharing

References / Resources:
https://medium.com/faun/security-automation-series-part-1-owasp-zap-jenkins-integration-50b091f29a36
https://www.youtube.com/watch?v=SmY8D8VTWdI
https://www.hahwul.com/2021/02/06/semiautomated-security-testing-using-zest-script-of-zap/
https://www.alldaydevops.com/zap-in-ten
https://www.youtube.com/watch?v=5oMp5O9CeSg
https://www.zaproxy.org/

Transcript

1. Presented by Share this talk @ZAProxyCon 9 March 2021 Security Automation with OWASP ZAP Gowtham Sundar Security Engineer - Freshworks
2. About Me • Senior Security Engineer @ Freshworks • ZAP Evangelist • Creator of Book of Bug Bounty Tips and Bug Hunter Handbook • Interested in Cloud and Container Security • Active Learner Contact: Linkedin - https://www.linkedin.com/in/gowtham-sundar-6669b380/ Twitter - https://twitter.com/gowsundar Blog - https://medium.com/@gowsundar
3. Agenda • ZAP Introduction • Web Application Security Automation Using ZAP • Problem / Challenges Statement • Solving Problem - The ZAP Way ◦ ZAP + Jenkins ◦ ZEST Scripts • Demos • Resources and References
4. OWASP ZAP (Zed Attack Proxy) - Introduction • Widely used Web Application Scanner • An OWASP Flagship Project • Free and Open Source • Well Maintained • Highly Flexible • New Automation Framework - To be Released
5. Security Automation with ZAP ZAP is the most widely used free and open source scanner across the world. Check out - Is ZAP World's Most Popular Web Scanner ? Current Automation Options • Command Line • Jenkins Plugin • Packaged Scans • Github Actions • Daemon + API
6. Problem / Challenge Statement - 1 Our Commercial Dynamic Application Security Testing (DAST) Tool’s • Scan Duration was “High” • Not Suitable for Continuous Integration (CI) ◦ Engineer’s had to trigger scan Manually • Not Flexible ◦ No Customization ◦ No Concurrent Scans ◦ Sharing of Credentials between Engineer’s Commercial DAST Tools RASP and other Solutions Commercial DAST Tools ZAP
7. Solution - The ZAP Way.. ZAP + Jenkins Integration (Plugin) • Key Highlights ◦ Completely Automated (CI Support) ◦ Highly Flexible / Configurable + =
8. Demo Time
9. Results • Completely Automated • Quick Scan Time • Centralized Control • Customized Scans
10. ZAP+Jenkins - Video Reference
11. Problem / Challenge Statement - 2 Performing Authenticated Scans ?? • Successful Scan using Form Based Authentication • Unable to handle Custom SSO Login ◦ Requires dynamic “callback_code” for authentication • Unable to perform authenticated scans ◦ Minimal Findings ◦ Less Application Coverage What type of AuthN Scheme You use? Custom SSO
12. Solution - The Z(AP)EST Way.. ZEST Scripts • What is ZEST ? ◦ An experimental scripting language initially developed by Mozilla ◦ Free and Open Source (included in ZAP by default) ◦ JSON Based ◦ Useful for creating custom scripts ◦ Multiple Features (Assignment, Assertion, Condition, Etc,.) • Other Supported Scripts ◦ ECMAScript / JavaScript ◦ Groovy ◦ Python ◦ Ruby ZEST Recorder
13. ZEST Script Console Overview ZEST Recorder Recorded Requests ZEST Results
14. Demo Time Scenario: • Consider an Application requires “dynamic token” during Login. Steps: • Record the Application Login Flow using via ZEST Recorder • Assign the “dynamic token” to a variable using ZEST Assignment Option • Modify the Login request to include the assigned variable • Successful Login !!
15. ZEST Script - Recording Login Flow / Assignment Assigning Dynamic Token to a variable using ZEST Assignment.
16. ZEST Script - Modifying Login Request Modifying Login Request to include the Dynamic Token from the “assigned” variable. Successful Login Flow
17. Results • Perform Authenticated Scans • Validation with ZEST Assertions • Wide Coverage • More Findings
18. ZEST Script - Video Reference
19. References / Resources • Security Automation With ZAP - Jenkins [Blog] • OWASP ZAP Advanced Features [Video] • Semi - Automated Security Testing with ZAP [Blog] • ZAP in Ten [Video Series] • ZAP Automation in CI / CD [Video] • ZAP Homepage
20. Presented by Share this talk @ZAProxyCon Thank You Please join us on the ZAProxyCon Discord Server! https://discord.gg/8ejQWfbb6p