‫Automated tools are an important part of pen testing of Web application.
‫We able to understand if there's a vulnerability on an input field, you should send thousands of different
‫payloads.
‫For example, you have to try hundreds of payloads to be sure that there is not an actual injection
‫vulnerability in the field.
‫There may be tens or hundreds of input fields in a website.
‫So only for the actual injection vulnerability, you have to give hundreds of thousands of tries in
‫a typical web application pen test.
‫So if you want to test the application manually.
‫Be my guest.
‫It's going to take months.
‫So to make it faster.
‫You should try using automated tools.
‫The OWASP Z attack proxy, otherwise known as Zap, is one of the world's most popular free security
‫tools.
‫It can help you automatically find security vulnerabilities in web applications.
‫So to answer your first question, what is always zap?
‫Zap is a tool to find the vulnerabilities in Web applications.
‫It's completely free and open source.
‫Because of the ease of use, it's ideal for people new to application security.
‫Zap is also a cross-platform tool, so you can use it on Windows, Linux and Macs.
‫It's easy to install, it requires Java to run.
‫Everything else is included in the standard download packages.
‫A full set of help files is included, and these can also be viewed on the web.
‫And Zap is a community project.
‫So there are hundreds of volunteers to improve it and to add new components on it all the time.
‫This app provides the essentials that you'll need for testing web applications.
‫First of all, it's a personal proxy to intercept and tamper with the HTTP and HTTPS traffic between
‫the browser and the server.
‫It provides both active and passive scanners, the passive scanner just examines the request and responses,
‫and it can detect certain types of vulnerabilities just on that basis.
‫It runs all the time you use app and it's safe to use on any site as it does not perform any attack
‫itself.
‫And on the other side, Active Scanner performs a range of attacks, so as you see in the next lecture,
‫spidering or crawling can be used to crawl the application, for example, to find pages that you've
‫either missed or which have been hidden from you.
‫Zaf can generate reports on the issues it has found, including advice and links to more information
‫about the problems.
‫They can also fuzz parameters, and you can use fuzzing to find more vulnerabilities that the automated
‫scanners can't necessarily find.