ZAP

ZAP API Documentation

This guide provides detailed instructions on setting up, configuring, implementing, and troubleshooting ZAP API for web application security testing. It covers all necessary steps with relevant screenshots and examples to help students understand the usage of ZAP for the class project.

Table of Contents

1. Installation
2. Configuration
3. Implementation
4. Usage
5. Troubleshooting

Installation

Prerequisites:

• Download Java JDK from the official Oracle download page. Choose the version that corresponds to your system (e.g., Windows, macOS, Linux).

• Install Java following the on-screen instructions.

• Open a new Command Prompt and check the Java version:

     java -version
  

Example:

Step 1: Downloading ZAP

For macOS:

• Visit the official ZAP download page.
• Select the appropriate version for macOS:
  • Intel (amd64)
  • Apple Silicon (aarch64)

For Windows:

• Download the ZAP installer:
  • Choose the Windows (64-bit) or Windows (32-bit) installer based on your system.

Example:

Step 2: Installing ZAP

After downloading, follow the installation prompts:

• On macOS, open the downloaded .dmg file and drag ZAP into the Applications folder.

• On Windows, run the installer and follow the on-screen instructions to complete the installation.

• Run the following command to verify the version:

  zap --version
  

• This will output the version of ZAP installed, e.g., OWASP ZAP 2.11.1

Configuration

Step 1: Setting Up ZAP Proxy

1. Open ZAP: Start the ZAP application.

Example:

2. Configure Proxy Settings:

• Go to Options > Network > Local Servers/Proxies.
• Ensure that localhost is set with Port 8081 (default).

Example:

Step 2: Configuring Firefox to Use ZAP as Proxy

1. Open Firefox and go to Settings > Network Settings > Manual proxy configuration.

2. Set the HTTP Proxy to 127.0.0.1 and Port to 8081.

3. Ensure the checkbox for Use this proxy server for all protocols is checked.

Example:

Implementation

Step 1: Verify Proxy Setup

1.Open Firefox and visit a test website (e.g., https://sec.cse.csusb.edu/team1).

2.In ZAP, go to Sites or History tab to see traffic being intercepted.

Example:

Step 2: Conducting Basic Scans

Spidering the Website:

1. Open ZAP, go to Manual Explore, enter the URL of the website, and start crawling.

Example:

Active Scanning:

1. After spidering, click the Active Scan button to scan for vulnerabilities on the identified pages.

Example:

Usage

Step 1: Passive Scanning

• Passive scanning monitors traffic between the browser and application without impacting the site's functionality.

• Typical vulnerabilities detected include:

  • Missing Security Headers
  • Insecure Cookies
  • Information Leakage

Example:

Step 2: Saving and Analyzing Reports

Generate a Report:

• After scanning, you can generate an HTML report by going to Reports > Generate Report.
• Choose the format and location to save the file.

ZAP Report

reports/ZAP-Report-.pdf

Example:

Review Alerts:

• ZAP will categorize the vulnerabilities found (e.g., XSS, SQL Injection) under the Alerts tab. Each alert has detailed descriptions and recommended fixes.

Example:

• Fig1: The summery of the alerts in side the report

• Fig2: The fig represents the types of alerts, Risk level and no of instances.

• Fig3: The fig represents the alert Missing click-jacking header.

Step 3: Viewing Results

• Results: Vulnerabilities with varying severity levels (low, medium, high, critical) are shown in the Alerts tab.
• Customizing the Scan Policy: You can adjust the scan policy by enabling or disabling specific attack types.
• You can view detailed information about each alert, including the risk level and possible exploitations.

Example:

• Viewing Alerts of the website inside ZAP tool

Troubleshooting

Issue 1: ZAP Not Opening on macOS

If ZAP fails to open, go to System Preferences > Security & Privacy > Allow Anyway under the General tab.

Example:

Issue 2: ZAP Not Capturing Traffic

• Double-check your browser’s proxy settings:

  • Ensure 127.0.0.1 and Port 8081 are configured correctly in both Firefox and ZAP.

Issue 3: For Windows Users

• Access Denied: Right-click the ZAP executable and select Run as Administrator.

Example:

Resources

ZAP User Guide:

• The official documentation provides detailed explanations on ZAP’s features, configuration, and usage:
• ZAP User Guide

API Documentation: ZAP has a powerful REST API for automation and integration:

• ZAP API Documentation