‫So as a Web application penetration tester, you'll always encounter HTTPS sites.
‫So you should know how to intercept HTTPS traffic as well.
‫Fortunately, it's easy to intercept HTTPS traffic using Zap, so here I am with the browser, where
‫the Port 80 80 of the local host is selected as the proxy.
‫And when I visit an HTTPS page like Google.com.
‫Firefox says that our connection is not secure.
‫Well, remember when we saw this before we were talking about intercepting traffic using the BRPs.
‫So to be able to intercept the traffic, zap handshakes with the website and we handshake WhatsApp.
‫Since we have an added, this app certificate is trusted.
‫Yet you get that message.
‫So let's go to the zap window and open the options panel using the button with the wheel icon in the
‫menu bar and on the left pane, select dynamic SSL certificate option.
‫So as you see, there is a route see a certificate for OWASP created before so we can use it or click
‫the Generate button to create a new one.
‫Now click the Save button and say the certificate anywhere you want.
‫Click Save.
‫Click OK to close the options panel.
‫Now let's have the certificate just like we learned before.
‫In Firefox over the menu, using the menu button at the upper right corner and select Preferences,
‫select Advanced from the Left Choose Certificates tab and click View Certificates and the Certificate
‫Manager Panel Open Click Import.
‫Select the certificate you saved a few seconds ago.
‫Now, in the Downloading Certificate Panel, select at least the first option.
‫Trust this CIA to identify web sites and click OK.
‫OWASP, Zapp, is that it is a trusted authority.
‫Now we're ready to capture and intercept HTTPS traffic, so in Firefox, visit an HTTPS page again and
‫as you see, no problem occurs now in the left pane of this app window, you'll see the GDPs web page
‫is captured by Zap.