Practical Security Automation and Testing

Step 2 – execution of 0d1n with OWASP ZAP

The following command will trigger fuzz testing against the NodeGoat login page. In addition, 0d1n can also easily define the proxy which we will specify OWASP ZAP here. Although running ZAP can be optional, it will be a supplement to 0d1n to detect security issue based on HTTP requests/responses:

$ ./0d1n --host 'http://nodegoat.herokuapp.com/login' --post 'userName=user1&password=^&_csrf=' --payloads ./payloads/user.txt --log log001 --threads 3 --timeout 5 --proxy 127.0.0.1:8090 --find_string_list ./payloads/response.txt --save_response --tamper randcase

Following are the list of commands used in execution of 0d1n:

Command options	Explanation of use
--host '<target Host>'	Define the target ...