A new tool is available for those who would benefit from automated penetration testing and who don’t have the internal know-how or resources to deal with the problem of security testing for their web or mobile applications. Zed Attack Proxy (ZAP) of the Open Web Application Security Project (OWASP) provides the user with the ability to conduct automated penetration testing on their web or mobile applications without all the fuss that usually goes along with such operations.
Today, when we put sensitive data online, more of our attention should be spent on the security aspects involved. We usually address this in a number of ways, by utilizing our own internal development team or by contracting a team of security experts with the requisite knowledge of the prevailing network penetration tactics of the day.
The problem with many developers is that they generally only have a foundational understanding of the various relevant security aspects involved, which means that you will need to spend significant resources qualifying them to the desired level if you wish to tackle your security procedures in-house. In most cases, however, if there is no such expertise in the company, it is not implement as part of a CI pipeline.
Nevertheless, it is a common occurrence to set up and run various penetration and other testing procedures. This is usually done upon release; and, the more important the release, the more time and effort spent on penetration testing, which leaves the inevitable possibility of more issues being discovered during testing. After all of this, there is a choice to delay the release and fix the issues encountered or to postpone patching in order to meet the desired deadline of release - which will almost invariably result in an increased probability of a security incident.
Automated penetration testing could alleviate this tedious cycle. One of the best tools for the job in this regard which you should consider is OWASP ZAP.
What is OWASP ZAP?
Zed Attack Proxy (ZAP) is a free and open-source penetration testing tool maintained under the umbrella of the Open Web Application Security Project (OWASP). ZAP is designed specifically for web applications testing and is flexible and extensible. Using ZAP will allow you to intercept requests to your application, modify them, and resend them to see how the app reacts.
This tool can also be used without any setup by non-security experts. It allows you to scan your web application with preconfigured parameters to get results with a detailed explanation of any possible vulnerability. However, to be confident about your web application security level, you’ll need to understand the basics of security testing as well as know how to properly use the tool.
ZAP hosts a number of features that can be applied to your particular case or situation, three that you should be aware of before using the tool are ZAP’s Passive Scanning, Active Scanning, and Quick Start Test functions.
Passive scanning
The passive scan feature is ZAP’s most well-know capability. It records all requests and responses from each element of your web application and sends an alert if there is something potentially wrong with the request or response. It is advisable to have an understanding of your web application’s basic security state and to locate places where additional investigation is required.
Active scanning
While passive scanning doesn’t change responses and is considered safe, active scanning is aimed at finding other vulnerabilities by using known attacks against certain areas of your application. You should use caution when applying this against applications you don’t have the appropriate permissions to test - active scanning is a real attack.
Quick Start Test
Quick Start Test allows you to run checks with some default parameters. You will only need to specify the target (URL or IP address with port specified) and run it. ZAP will proceed to crawl the web application, passively scanning each page it finds. ZAP will then engage the active scanner to attack all of the discovered pages, functionalities, and parameters.
Using this tool properly will allow you to increase the security level of your web or mobile applications. Being integrated into the pipeline, it will receive prompt notifications on the availability of security updates and will make sure your app is up-to-date with the latest standards. By taking advantage of ZAP’s scanning and quick start features, you’ll be able to benefit from professional level security testing without having to worry about the technical knowledge and industry expertise normally required.
We’re ready to help you bring the security of your existing applications to the next level using this and many other special tools.
