Instructor: So far we learnt how to manually discover
a number of very dangerous vulnerabilities.
We seen how they work and how to exploit them.
In today's video, I'd like to show you a tool
that will allow you to automatically discover
vulnerabilities in web applications.
It will allow you to discover the vulnerabilities
that we learned, plus much more.
The reason why I didn't teach you this at the start,
because I wanted you to learn how to do it manually,
and I also wanted you to know
how this vulnerabilities occur,
so to understand the reason behind them.
Also this are just tools,
so this program is just a tool,
it can make mistakes and it can show false positives.
It can also miss vulnerabilities in some cases.
Therefore, I wanted you to know
how to do this stuff manually,
so if the program doesn't work
or if the program misses something,
then you'll be able to find it.
The best way to use these programs is as a back up
or as just a tool to help you with your penetration testing.
So using the tool is very simple.
I'm gonna go on my applications
and then I'm gonna type in ZAP.
And it's asking me if I wanted to save the current session
when I search for something, so I'm gonna say no.
And this is the main view of the tool,
so on the left here you'll see the websites
that you're targeting.
On the right, you can attack and send the website URL,
and in here you'll see the results for your attacking
or for your scan.
If we go here on the cog on the left,
it'll allow you to modify the options for the program.
So you can modify certain aspects of it,
the way the fuzzer works, the way the spider works,
the way the scan works.
I'm gonna leave everything the same.
Another thing that you can modify
is the policies used in this scan,
so it's something similar to these scans
that we we're using with andmap,
the intense scan and all of that.
So I'm gonna press on the plus,
I'm gonna press on the active scan,
and if you press on this,
on the left here,
and I'm gonna press under default policy,
now you can create your own policies
by using the add button,
I'm gonna press on the default one
and I'm gonna go on modify
to show you the aspects that you can modify.
So right here we can modify the name,
the threshold and the strength for the global policy.
Click in on each of these categories
will allow you to modify the specific scans
that will be performed.
For example, in the injection tab here,
we can see all the injection scans
that the program is going to try.
For example, we can see SQL injections here,
we can see Cross-site scripting here,
and pressing on the threshold right here
we can set this to default, low, medium or high.
Setting it to the default
will just default to the value selected here
which is medium right now,
or you can have for example,
if SQL injection is what you're looking for,
if what you're looking for is access from the database,
then you can set this to high
so that it'll try everything
and it'll try to find it in even difficult places.
So I'm gonna close all of this
I'm leaving everything the same,
and I'm gonna start my attack against the mutillidae script,
so we have it in 10.20.14.204
running in metasploitable machine,
and if we go on Mutillidae right here,
that's the URL,
so literally I'm just gonna copy this,
and paste it here,
And then I'm gonna attack.
Now the tool is first gonna try to find all the URL's
and then it's going to try and attack this URL's
based on the scan policy that we used.
I'm gonna pause the video
and resume it once the scan is over.