How to Detect Web Application Vulnerabilities with OWASP ZAP

As cyber-attacks on web applications increase day by day, security tests are becoming critical. At this point, OWASP ZAP stands out as an indispensable open source testing tool for security experts and developers.

OWASP ZAP is an easy-to-use tool that can automatically detect vulnerabilities in web applications, offering comprehensive scanning features. It provides a wide range of security checks from passive scanning to active attack tests.

In this guide, we will examine all features of OWASP ZAP step by step, from installation to advanced scanning techniques. We will cover important topics such as proxy settings, Spider usage and custom scanning policies in detail.

Installing and Configuring OWASP ZAP

The installation and configuration process of OWASP ZAP is an important stage that must be carefully completed before starting security testing. Certain steps must be followed for this powerful security testing tool to work correctly.

System requirements and installation steps

OWASP ZAP is a multi-platform tool and can run on Linux, MacOS and Windows operating systems. Basic requirements for installation:

• Java (preferably Java 8) must be installed
• ZAP version suitable for the operating system
• Minimum 4GB RAM recommended

The installation process starts by downloading the version suitable for the operating system from the official website of OWASP ZAP. While it is enough to run the installation file for Windows users, the installation can be completed with the ‘owasp-zap’ command on Linux systems.

Basic configuration settings

After the first start-up of ZAP, the basic configuration settings should be made as follows:

1. Selecting the vehicle language (many languages are supported)
2. Review of default scanning policies
3. Secure storage of the API key

Making proxy settings

Proxy configuration is critical for ZAP to analyse web traffic. Basic proxy settings are performed with the following steps:

1. Specify the proxy address from the Tools -> Options -> Local Proxy menu (localhost:8080 is used by default)
2. Redirecting browser proxy settings to ZAP
3. Installing SSL certificates and defining security exceptions

After the proxy settings are completed, all web traffic passing through ZAP can be viewed in the Sites History section. The important point to note at this stage is that if an in-house proxy is used, the necessary settings should be made from the Tools -> Options -> Connection screen.

Performing the Initial Security Scan

Fast scanning optionsTo perform a security scan with OWASP ZAP, users are offered two different modes: automatic and manual scanning. In this section, we will examine step by step how to perform the initial security scan.

Determination of the target URL

It is critical to correctly identify the target URL before starting the scanning process. The URL is written in the ‘URL to attack’ section on the ZAP home page. Users may need to obtain permission from the target server to their public IP before scanning.

Fast scanning options

OWASP ZAP’ta tarama işlemi iki temel modda gerçekleştirilebilir:

Auto Scan Mode:

• It is enough to enter the URL and press the ‘Attack’ button
• ZAP automatically sends requests to the page and starts the scan
• Spider tool explores all directories and files of the site

Manual Scan Mode:

• ZAP is activated via the proxy plugin
• The traffic of the visited pages is displayed on the ZAP home page
• Selected pages are scanned with the Manual Explore button

Understanding scan results

When the scan is complete, ZAP provides the following information:

• Risk Levels: Especially findings at the ‘High’ level should be analysed immediately
• Detailed Report: For each finding, category, risk group, attack information and solution proposal are presented
• Directory Analysis: Directories and files belonging to the site are listed on the left side

ZAP needs approximately 20 seconds to process the scan results and reflect them to the API. During this time, all vulnerabilities and risks found are reported in detail.

Active and Passive Scanning Techniques

One of the most powerful features of OWASP ZAP is that it combines both passive and active scanning capabilities. These two scanning approaches play different roles in the security assessment of web applications.

How passive scanning works

Passive scanning is the process of collecting information without direct interaction with the target system. This method works through a proxy mechanism that captures and analyses the traffic between the client and the server. When ZAP is activated, the traffic of each visited page is automatically displayed on the home page.

The main advantages of passive screening:

• Leaves no trace in the target system
• Not detectable by security systems
• No risk of disrupting critical processes

Active scanning features

Active scanning sends specially crafted requests to the server to detect security weaknesses. This method performs automated tests to identify common vulnerabilities such as SQL injection, XSS and security misconfigurations.

Features of ZAP in active scanning mode:

• Automatic vulnerability detection
• Prepared attack scenarios
• Detailed reporting features

Privatising screening policies

Scan policies define the rules to be executed during active scanning. Users can create and manage multiple scan policies through Scan Policy Manager. The following settings can be customised for each policy:

• Enabling/disabling scan rules
• Vulnerability reporting thresholds (Low/Medium/High)
• Levels of attack intensity

The scan policy manager also allows policies to be exported and imported into other ZAP installations. This feature makes it easy to share consistent scan configurations across teams.

Advanced Scanning Features

For advanced security testing, OWASP ZAP offers comprehensive scanning tools. These tools enable in-depth security analysis of web applications.

Spider and Ajax Spider usage

The Spider feature of OWASP ZAP is used to map the structure of web applications. Ajax Spider uses Crawljax technology to crawl JavaScript-based content in modern web applications. Spider features include:

• Fast scanning with multi-window support
• Ability to crawl at unlimited depth
• Automatic value entry to form fields
• JavaScript-based dynamic content analysis

To improve the performance of Ajax Spider, users can open multiple windows and set the maximum crawl depth.

Performing fuzzing attacks

Fuzzing is a testing technique that aims to detect vulnerabilities by sending unexpected data to systems. In OWASP ZAP, the fuzzing process is performed with the following steps:

1. Request selection and access to the ‘Attack/Fuzz’ menu
2. Determination of payload generators
3. Configuration of fuzzing location processors
4. Setting up message processors

Fuzzing tests are effective in detecting vulnerabilities such as buffer overflow, DoS and SQL injection.

WebSocket security tests

WebSocket tests are critical for assessing the security of bidirectional communication channels in modern web applications. ZAP can capture and analyse WebSocket traffic and perform security tests. WebSocket security tests focus on the following areas:

Origin Check: The server is checked to validate the Origin header in the WebSocket handshake.

Confidentiality and Integrity: TLS usage and encryption status of WebSocket connections are evaluated. By default, the wss:// protocol is used over port 443.

Input Validation: Sanitisation and encoding checks are performed for data coming over WebSocket. ZAP can capture and modify WebSocket messages and apply fuzzing tests.

Thanks to these advanced features, OWASP ZAP is able to comprehensively test the complex security requirements of modern web applications.

Conclusion

OWASP ZAP proves to be a comprehensive and powerful tool for security testing of web applications. The wide range of functions it offers, from a simple installation process to advanced scanning features, significantly simplifies the work of security experts.

The success of security tests is directly related to the correct configuration and selection of appropriate scanning techniques. Effective use of all features, from passive scanning to active attack tests, from Spider usage to WebSocket security controls, ensures early detection of potential vulnerabilities in web applications.

Security testing is a continuous and regular process. Thanks to the automatic scanning features and customisable policies offered by OWASP ZAP, organisations can standardise their security testing processes and make them sustainable.

OWASP ZAP Frequently Asked Questions