Hello everyone and welcome.
In this video we will go over Zap proxy, which is a tool that is used to do advanced web security scanning.
For that, let's go through this documentation.
I haven't created any slide as such.
This document is very well written, so I'll walk you through the documentation about some of the basics
of security testing and also what the tool does.
So in this particular section it shows the overview of the tool which is Zap proxy.
Zap proxy is used to perform security testing.
Even if you don't have a background security testing that should not matter.
It would guide you effectively through how the tool works.
Some of the basics and security testing.
Software security testing is the process of assessing testing a system to discover security risk and
the vulnerability of the system and its data.
It is broadly categorized into four categories.
Vulnerability assessment the system is scanned and analyzed for security issues.
Penetration testing system undergoes analysis and attack for simulated malicious attackers.
Runtime testing system undergoes analysis and security testing and code review system code undergoes
a detailed review and analysis looking specifically for security vulnerability.
Little bit more about penetration testing is that it is carried out as if tester was malicious, with
a goal of breaking into the system, either stealing data or carrying out some sort of denial of service
attack.
Pentesting has an advantage of being accurate because it has fewer false positives.
Pentesting is also used to test defense mechanism, verify response plans and security policy adherence.
So how does the pen testing process look like?
It is broadly categorized into three steps.
First, it explores the tester attempts to learn about the system being tested.
It includes trying to determine what software it uses, what endpoints, patches, etc. and then it
includes searching the site of hidden content, vulnerabilities and other indications of weakness.
Then it plans the attack.
The attestor attempts to exploit the known or suspected vulnerabilities to prove they exist, and the
third one is report tested.
Reports back the results of their testing, including the vulnerabilities.
Let's score down a little bit and understand how Zap works.
The ultimate goal is to search for vulnerabilities so that these vulnerabilities can be addressed.
It can also verify that a system is not vulnerable to unknown class or a specific defect.
In the case of vulnerabilities and there has been reported as fixed, verify that the system is no longer
vulnerable to that defect.
So what is zap?
Zap is Zed attack proxy by Checkmarx.
It's a free, open source penetration testing tool that would expose the web security vulnerabilities,
web applications.
And it's both flexible and extensible.
So if you notice here, it sits between a browser and the web application so that it can intercept the
message and send browser and web application modify the contents if needed.
Now let's go ahead and understand how Zap proxy looks like.