‫So let's see how to install and perform the first scan using the quick scan option.
‫First, let's see how to download and install OWASP.
‫Zap.
‫In a browser, I search for OWASP Zap.
‫So, you know, are the Google advertisements on top?
‫But the first link is the link to OWASP is that attack proxy, oh, wasps, that attack proxy pages
‫have a lot of helpful information about the tool.
‫So by clicking download now, it brings us to the GitHub page of the Wasp Zap tool.
‫Here you have some packages and installers for different platforms, so you can choose the appropriate
‫one and click it to download because I want to use sap with my colleague.
‫I'll download Linux installer or package, so I'll choose the Linux installer.
‫Now here is, you see, I already have the package downloaded before, so I'll ignore this stuff.
‫But importantly, the Linux Installer link brings you the file with the Dot S.H. extension.
‫And when you analyze it with a file command, you'll see that it's an executable shell script.
‫To run it, type, dot, slash and the file name inside the folder, but hold on.
‫The file does not have the execution rates by default.
‫So to make it executable by everybody Type C Age Mod 75 file name.
‫Now it's executable, and we can type that slash and file name to install Zap.
‫But since it's already embedded in Cali, I'm not going to need to install it again.
‫So to use OWASP, Zap Type, OWASP, Dash, Zap in anywhere and hit enter or open the applications menu
‫and type O was the find the tool and click its icon to start Zap.
‫As you see, the downloaded version and the embedded version are the same.
‫So that means we have the current version of his app in our calling.
‫So now it asks if you want to save this obsession?
‫I'll choose No.
‫No worries.
‫I mean, you can say the session whenever you want.
‫So now let's see the quick scan option of Zap in the Quickstart tab.
‫Enter the URL address of the application you want to scan and click the attack button to start the scan.
‫First, the spider runs to crawl the application.
‫And at the left pane of the zaps user interface, you'll see the discovered pages of the application.
‫So now they're yellow or orange flag icons next to some of the pages and folders.
‫That means Zap has already found some medium and low level vulnerabilities.
‫So look at the Alerts tab, you'll see all the vulnerabilities found by now.
‫And as we said before, Zap runs the passive scan all the time you use it, so it's always running in
‫the spidering phase as well.
‫Now, look at the dam vulnerability web applications folder DVD way, you see, the only page discovered
‫is a login page.
‫The application allows us to see only the log in screen if we don't log in to the app that doesn't have
‫any valid session or credentials, so it can only find the login page of the DVD app.
‫And here you can stop or pause the spidering phase by clicking any of the buttons inside the Spider
‫tab.
‫And to make the demonstration faster, I'll stop the spidering phase now.
‫So as soon as the spidering phase finishes, Zap starts the active scan phase.
‫In the active scan tab, there is a button to show the scan progress details and Samus Spider, you
‫can stop or pause the active scan phase by clicking the corresponding button and any alerts tab.
‫We'll see the numbers of the findings are increasing.
‫So let's look at the scan progress details.
‫Now, the left side of the panel there, the names of the vulnerabilities tested by Zap, the Rex column
‫show the number of requests sent to test that vulnerability.
‫The progress column shows the current status of the progress for that particular vulnerability.
‫And you can stop or cancel any test for a vulnerability by clicking the small button at the right side
‫of the row of that vulnerability.
‫Zap continues to the next vulnerability test.
‫Here it finds some vulnerabilities in high severity level is a reflected excess.
‫Don't worry, we'll see the vulnerability in detail.
‫So here is a request sent to test the reflected XSS vulnerability.
‫Now, here's an important warning about the automated tools.
‫The findings of the tool might be a false positive.
‫A false positive is where you receive a positive result for tests when you should have received a negative
‫result.
‫So it sometimes is called a false alarm.
‫So you have to verify any finding.
‫So now let's see if the script code executes in this excess test.
‫It's a get request, so there is not any particular parameter in the body, we can simulate the attack
‫just by copying and pasting the URL of the test request.
‫Now see how the script runs.
‫The finding is a true positive.
‫So I think that's enough.
‫I don't think there's any need to wait until the end of the scan.