book

Zed Attack Proxy Cookbook

Name: Zed Attack Proxy Cookbook
ISBN: 9781801817332

by Ryan Soper, Nestor Torres, Ahmed Almoailu

March 2023

Intermediate to advanced

284 pages

6h 10m

English

Packt Publishing

Read now

Unlock full access

Zed Attack Proxy Cookbook
ContributorsAbout the authorsAbout the reviewersDisclaimer
Preface
Who this book is forWhat this book coversTo get the most out of this bookDownload the example code filesDownload the color imagesConventions usedSectionsGetting readyHow to do it…How it works…There’s more…See alsoGet in touchShare Your ThoughtsDownload a free PDF copy of this book
Chapter 1: Getting Started with OWASP Zed Attack Proxy
Downloading ZAPGetting readyHow to do it...Installing DockerSee alsoSetting up the testing environmentGetting readyHow to do it...How it works...There’s more...Setting up a browser proxy and certificateGetting readyHow to do it...How it works...Testing the ZAP setupGetting readyHow to do it...How it works...
Chapter 2: Navigating the UI
Technical requirementsPersisting a sessionGetting readyHow to do it…How it works…Menu barGetting readyHow to do it…How it works…There’s more…ToolbarGetting readyHow to do it…How it works…See alsoThe tree windowGetting readyHow to do it…How it works…Workspace windowGetting readyHow to do it…How it works…Information windowGetting readyHow to do it…How it works…There’s more…FooterGetting readyHow to do it…How it works…Encode/Decode/Hash dialogGetting readyHow to do it…How it works…See alsoFuzzing with FuzzerGetting readyHow to do it…How it works…There’s more…See also
Chapter 3: Configuring, Crawling, Scanning, and Reporting
Technical requirementsSetting scope in ZAPGetting readyHow to do it…How it works…Crawling with the SpiderGetting readyHow to do it…How it works…Crawling with the AJAX SpiderGetting readyHow to do it…How it works…There’s more…See alsoScanning a web app passivelyGetting readyHow to do it…How it works…There’s more…See alsoScanning a web app activelyGetting readyHow to do it…How it works…There’s more…See alsoGenerating a reportGetting readyHow to do it…How it works…See also
Chapter 4: Authentication and Authorization Testing
Technical requirementsTesting for Bypassing AuthenticationGetting readyHow to do it…How it works…Testing for Credentials Transported over an Encrypted ChannelGetting readyHow to do it…How it works…Testing for Default CredentialsGetting readyHow to do it…How it works…There’s more…See alsoTesting Directory Traversal File IncludeGetting readyHow to do it…How it works…See alsoTesting for Privilege Escalation and Bypassing Authorization SchemaGetting readyHow to do it…How it works…Testing for Insecure Direct Object ReferencesGetting readyHow to do it…How it works…There’s more…
Chapter 5: Testing of Session Management
Technical requirementsMutillidae setupTesting for cookie attributesGetting readyHow to do it...How it works...Testing for cross-site request forgery (CSRF)Getting readyHow to do it...How it works...Testing for logout functionalityGetting readyHow to do it...How it works...There’s more...See alsoTesting for session hijackingGetting readyHow to do it...How it works...There’s more...See also
Chapter 6: Validating (Data) Inputs – Part 1
Technical requirementsTesting for reflected XSSGetting readyHow to do it…How it works…There’s more…See alsoTesting for HTTP verb tamperingGetting readyHow to do it…How it works…There’s more…See alsoTesting for HTTP Parameter Pollution (HPP)Getting readyHow to do it…How it works…See alsoTesting for SQL InjectionGetting readyHow to do it…How it works…There’s more…See also
Chapter 7: Validating (Data) Inputs – Part 2
Technical requirementsTesting for code injectionGetting readyHow to do it...How it works...Testing for command injectionGetting readyHow to do it...How it works...There’s more...See alsoTesting for server-side template injectionGetting readyHow to do it...How it works...There’s more...See alsoTesting for server-side request forgeryGetting readyHow to do it...How it works...There’s more...See also
Chapter 8: Business Logic Testing
Technical requirementsTest ability to forge requestsGetting readyHow to do it…How it works…See alsoTest for process timingGetting readyHow to do it…How it works…See alsoTesting for the circumvention of workflowsGetting readyHow to do it…How it works...See alsoTesting upload of unexpected file types with a malicious payloadGetting readyHow to do it…How it works...See also

Chapter 9: Client-Side Testing
Technical requirementsTesting for DOM-based cross-site scriptingGetting readyHow to do it...How it works...There's more...Testing for JavaScript executionGetting readyHow to do it...How it works...There's more...Testing for HTML injectionGetting readyHow to do it...How it works...There's more...Testing for client-side URL redirectGetting readyHow to do it...How it works...There's more...Testing cross-origin resource sharingGetting readyHow to do it...How it works...There's more...Testing WebSocketsGetting readyHow to do it...How it works...There's more...See also
Chapter 10: Advanced Attack Techniques
Technical requirementsPerforming XXE attacksGetting readyHow to do it...How it works...Working with JSON Web TokensGetting readyHow to do it...How it works...There’s more...Performing Java deserialization attacksGetting readyHow to do it...How it works...There’s more...See alsoPassword brute-force via password changeGetting readyHow to do it...How it works...See alsoWeb cache poisoningGetting readyHow to do it...How it works...See also
Chapter 11: Advanced Adventures with ZAP
Technical requirementsHow to use the ZAP GUI local API to scan a targetGetting readyHow to do it…How it works…How to use the ZAP API via DockerGetting readyHow to do it…How it works…There’s more…See alsoUtilizing ZAP DAST testing with JenkinsGetting readyHow to do it…How it works…There’s more…See alsoInstalling, configuring, and running the ZAP GUI OAST serverGetting readyHow to do it…How it works…There’s more…See also
Index
Why subscribe?
Other Books You May EnjoyPackt is searching for authors like youShare Your ThoughtsDownload a free PDF copy of this book

Overview

"Zed Attack Proxy Cookbook" is your comprehensive guide to mastering OWASP's ZAP tool for web application security testing. With practical recipes and real-world scenarios, you will learn how to detect and mitigate vulnerabilities in web applications and APIs effectively. Whether you're a cybersecurity professional or an aspiring ethical hacker, this book provides the tools and techniques to bolster your web application security.

What this Book will help me do

Install and set up Zed Attack Proxy (ZAP) in various environments to start securing applications.
Execute effective security assessments of web applications and APIs using ZAP's comprehensive tools.
Learn to identify and prevent vulnerabilities such as XXE attacks, SQL injection, and Java deserialization.
Implement out-of-band testing techniques with tools like the BOAST server for deeper security insights.
Integrate ZAP with CI/CD pipelines to automate security testing within your development workflows.

Author(s)

Ryan Soper, Nestor Torres, and Ahmed Almoailu are a collective force in the field of cybersecurity. With years of experience as ethical hackers, DevSecOps experts, and security educators, they bring their deep knowledge and hands-on expertise to this book. Their teaching methodology is focused on providing practical and actionable guidance, empowering readers to secure their systems effectively.

Who is it for?

This book is tailored for cybersecurity professionals, ethical hackers, application security engineers, and DevSecOps practitioners who aim to enhance their web application security capabilities. It's also suitable for students and enthusiasts looking to explore cybersecurity with ZAP. A foundational knowledge of cybersecurity concepts is recommended to maximize learning from this comprehensive guide.

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Hands-On Web Penetration Testing with Metasploit

Publisher Resources

ISBN: 9781801817332

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills