Hello everyone and welcome.
In this video, we will learn about the Zap proxy as a tool and run it using a UI interface and also
using a CLI interface.
So now let's go ahead and download this installer.
Here they have provided different ways on different axes and different download installers that you
can use.
I have used windows 64 installer since I'm running on windows operating system.
You can use Linux installers, Mac and different packages that are here for downloading and installing
your for your operating system.
You'll have to go here zap proxy download where it would provide all the download material.
I went ahead and downloaded this and executed it on my end.
I'll open the web UI and execute this.
So here is how the tool looks like.
There are different options available.
Automated scan, manual.
Explore and learn more.
I'll go ahead and click on the automated scan.
And here's the URL that we want to check for the attack.
They have this traditional spider option which you can go and read about the details on this spider
experience that they offer.
And then it also checks which browser you can run this against.
So what I'm going to do is I'm going to use a website here by the name hackthissite.org.
Here is where it's an open source site where it was built to check the different penetration testing
that can be offered and be tested on this website.
I'll go ahead and do attack.
So what this tool would do is it would go and run the pen test on this website and collect all the information
that it found that our vulnerable and could be fixed to make this side better.
It takes some while for it to go through the entire process.
I will go ahead and pause the video and resume it when it's done.
So the tool is done executing the the pentesting on this website.
And if you notice here here are the findings.
Let's go ahead and pick the first one and see what the details are.
For this particular finding, there are in total 27 findings.
Out of that we picked up absence of antiques.
So the URL it scanned here is this.
And it says the risk is medium.
And the description about this is that no antiques tokens were found in an HTML submission form.
The cross-site request forgery is an attack that involves forcing a victim to send an HTTP request to
a target destination without their knowledge or intent, so that is the vulnerability that it found.
Let's pick up another one.
CSP script source unsafe inline.
The risk was medium and it is content security policy.
The description is here.
So this is how the tool uses the UI interface to find the vulnerabilities for pen testing.
Now let's go ahead and do the same thing using a CLI.
So here I am on my windows PowerShell.
This is the root directory where I have my zap proxy installed.
I'm going to use the the command zap proxy for it to run and execute the the URL from this location.
Looks like I did not copy the right one.
Let me get the right URL for this command.
So here's the command Java with the memory zap 2.1 16.1.
Using the quick URL as hackthissite.org, and run this as a command with quick progress and then execute
this.
This would do things very similarly that we did with the UI interface.
The only difference is that it would be on the CLI.
The reason I'm showing this to you is because we would use this feature, the CLI command and feature
on our AI agent to do the advanced web scanning using AI agents.
This will take a while.