‫As I said before, one of the main features of the Z attack proxy is not surprisingly being a personal
‫proxy.
‫You can use it as a personal proxy to intercept and tamper with the HTTP and HTTPS traffic between the
‫browser and the server.
‫We are already seen a personal proxy by now, which is Burp Suite.
‫And the interception feature of Zap works a little differently from Burp Suite.
‫So let's see how Zap intercepts the traffic.
‫So I want to start a new session to avoid the complexity.
‫From the file menu, select new session and click, OK.
‫Now let's go to the options panel.
‫To open the panel, you can use the options icon from the menu bar, which looks like a wheel.
‫Alternatively, you can select options from the tools menu, or you can even use the key command control
‫alt oh two over the options panel, so the left side of the options panel select local proxies.
‫Here you see the local proxy address, which is the local machine by default and the listening port
‫again eight zero eight zero by default.
‫Zap starts to listen to the port eight zero eight zero when it started, so click OK to close the panel
‫for now.
‫But unless check to be sure if the port eight zero eight zero is open.
‫Opening terminal screen use netstat NLP to list the TCP ports, which are in listening mode and as you
‫see the state of the port, eight zero eight zero is listen.
‫And a Java application Zap is listening to the port.
‫OK, so let's open a browser window now.
‫Here is Firefox with foxy proxy plug in install, so right click the Fox icon.
‫We are ready to find a proxy for the four zero eight zero the local machine.
‫Select the proxy.
‫And now there's a site.
‫Make sure you visit in HTP page.
‫We'll see intercepting HTTPS traffic WhatsApp in the next lecture.
‫So I'll visit OWASP Broken Web Application.
‫As you know, UWW Dot, OWASP, BW Wacom is mapped with the IP address of my OWASP BW, a virtual machine
‫and visit a page on the OWASP BWR website.
‫I click, for example, OWASP Web Goat Link.
‫So turn back to zap.
‫You'll see that WW Dot, OWASP, BW Wacom folder is created and it has a web goat subfolder in it.
‫So now let's visit another page on the web site.
‫Click Dam Vulnerable Web Application in this app window.
‫We have another subfolder for DVD now.
‫In Firefox, I log in to DVD way and visit the excess reflected page here to ask my name, and when
‫I enter the name and click Submit.
‫It says hello.
‫So go to this app window.
‫There is another subfolder with the name vulnerabilities under the DVD subfolder.
‫And here are the visited pages I find the requests for reflected excess page, right click on it and
‫select Break and click Save.
‫Now there is a breakpoints tab in the bottom pane and the link of the access has reflected.
‫Page is here as a break point.
‫So now go back to Firefox again and revisit the excess reflected page.
‫And as soon as we click the link, the Zap window becomes the active one.
‫Look at the right pane.
‫There's a new tab pane called break.
‫And here is the request sent by the browser.
‫Now there are buttons on the menu bar.
‫This one submits your changes on the request and steps to the next packet.
‫And this one submits your changes and continues to the next breakpoint.
‫Remember that different now click them to release to traffic and go back to the browser.
‫Now on the reflected excess page.
‫All right, Jack is the name and click Submit.
‫So again, request is intercepted by Zap, and here it is.
‫I find the name parameter convert jack to William and click the Submit and Continue button.
‫So I go back to the browser, as you see, we submitted Jack from the browser, but the result is Hello,
‫William.