‫So let's talk about the most important feature of Zap.
‫Of course it's scanning.
‫We've already seen the quick scan feature of Zap, so.
‫Now, let's have a look at scanning with Zap in depth.
‫First, I want to scan Dam Vulnerable Web application DVD way without a valid user or session.
‫So to start a new session from the file menu, select new session in Firefox, while the port eight
‫zero eight zero of the local host is selected as proxy.
‫Visit the OWASP BWR website.
‫And click Dan Vulnerable Web application link and go back to the Zap window.
‫So here a sub folder for DVD Ray is created as we expected, right click the folder.
‫So in the Attack submenu, select Spider to crawl the application.
‫And there it is, a spidering is finished in almost milliseconds, but as you know, DVD allows you
‫to only visit the login page if you haven't logged into the application.
‫So Zap can only crawl the login page and some images and cascading style sheets.
‫And that's about it.
‫So if you start the active scan in this situation, all the attack modules will run on the login page
‫only, so you can only find out the vulnerabilities of the login page.
‫So sure, the attack is completed in under a second, but only because a single page has been scanned.
‫So when you look at the Alerts tab, you can only see a few medium and low alerts.
‫But we know that the application is -- vulnerable and there are a lot of high severity vulnerabilities.
‫So what we have to do is create a valid user or session so that we are able to scan more.
‫So let's start over.
‫Exit and reruns app for a brand new start.
‫Now go to the browser, configure the proxy as the port eight zero eight zero of the local host and
‫visit the DVD application.
‫I log into the application using admin admin credentials and visit a few pages on the app.
‫To go back to this app window.
‫Here is a subfolder of DVDs.
‫The login page and the visitor pages.
‫Did you recognize the yellow flags next to the pages and folders?
‫Remember, Zap runs the passive scan all the time you use it, so it's running now and reporting the
‫findings.
‫Look at the Alerts tab.
‫So before creating a new context, it's better to talk about some of the context of Zap.
‫Context are a way of relating a set of URLs together, so you can define any context you like, but
‫it's expected that a context will correspond to a web application.
‫So it's recommended that you define a new context for each web application that makes up the system
‫you were testing and set them in scope as you test each one.
‫Now, right click the DVD, a subfolder from include in Context submenu.
‫Select Default Context to add the application into the default context.
‫The Session Properties panel opens by clicking the root node of the default context.
‫You can change the name of the context with an appropriate one.
‫Click OK to close the Session Properties panel for now.
‫So as you see the DVD subfolder and the files in it are marked with a red sign.
‫So you can open the Session Properties panel at any time using the button in the menu bar.
‫Let's click the button to open the panel again.
‫Here we have some details of the context.
‫For example, click the session management option is either currently selected session management method
‫for that context in the authentication option.
‫We're supposed to select the authentication method.
‫The authentication method of DVD air is form based authentication.
‫So I leave it with the default values for now and click OK to close the panel again.
‫Now, find the log in request on the left side.
‫You see the parameters in the parentheses.
‫Right click on it under the flag is Context submenu, select form based off login request option session
‫properties panel appears.
‫And as you see, the authentication method is selected as form based authentication and the configuration
‫fields such as log in form target URL are filled automatically.
‫Well done, zap.
‫Here we should select the correct parameters username parameter for the username and password parameter
‫for the password.
‫Click OK to close the panel.
‫Now reopen the Session Properties panel.
‫So do you see either the log in request post data is prepared to be able to use it with different username
‫and password pairs.
‫But before closing the panel, let's enter one or more valid credentials of the application.
‫So select the users option under the context note.
‫The admin credential is already collected by this app.
‫So once again, well done.
‫Click the box to enable it.
‫Click Add to add another credential.
‫Give it a name.
‫Enter the username and password values and click Add.
‫So now two credentials are added in enabled.
‫So just under the users option, there's another option.
‫Forced user you can select a user here, which will be used for all the requests made for this context.
‫Only if the forest user mode is enabled, click OK and close the panel.
‫So looking back at the menu bar here, there's a button to enable forced user mode.
‫It's disabled by default, but click the button to enable the force user mode.
‫Now, let's go to the Session Properties panel once again and select the authentication option.
‫There are two other options at the bottom of the page while crawling or active scanning, Zap will try
‫every single link and feel, and during these tries it will probably log out the application.
‫And in these cases, the application will understand the logout and then reload again to the application
‫to be able to keep going.
‫So that means we have to teach the application when it's logged in or not.
‫And for this purpose, we should find something which can only be seen in the private pages.
‫And by that, I mean the pages you can only access if you're logged in.
‫So close a panel, find a page which is accessible only if you're logged in, for instance, indexed
‫at BHP.
‫Go to the Response tab and look at the body.
‫Select a part of the body.
‫This part looks good, so like the pattern, right click from Flag is Content submenu, select authentication
‫logged in indicator.
‫So this Session Properties panel appears again and this time rejects pattern identified in logged in
‫response message is filled in with our selection.
‫So close the panel now we're ready to attack the app.
‫Select the DVD sub folder, right click on it.
‫There are several options under the attack menu.
‫Of course, we should spider the first.
‫So when the Spider panel select, the user context is already selected and click the Start Scan button
‫to start the spidering phase.
‫And spidering is finished in second.
‫So now we have some alerts in the Alerts tab, which have been collected by the passive scan module
‫of Zap.
‫And we have some new pages in the left hand side of the app Tree.
‫You're there's a sub folder named Vulnerabilities, and there are more pages inside the folder.
‫So go to the History tab.
‫We see a lot of consecutive authentication attempts.
‫It seems that something went wrong but never give up.
‫One of the most important things have penetration testing is being patient.
‫You'll encounter a lot of different problems in a test and you should fix them or find other ways.
‫So let's have a look.
‫We may have made mistakes when assigning input values log in URL logged in pattern or credentials.
‫Let's go back and look at the application tree again.
‫Oh, wait a second.
‫Are these requests to change a password?
‫While crawling the application, Zap tries zap word in every field.
‫Unfortunately, in the DVD application, there are a few pages to change the password, and these pages
‫only ask the new password and confirmation of the new password.
‫They should have asked the current password.
‫But, you know, this is a -- vulnerable application.
‫So the password change attempt looks like it's unsuccessful on capture page because it also needs the
‫capture to be validated, and when we look at the request for the CSF page, we see that Zap sends zap
‫word for both the new password and confirmation of the new password.
‫So it seems like a valid password change request.
‫So now let's look at the body of the response now.
‫Here is the password changed message.
‫It looks like Zepp has changed the password of the admin user accidentally.
‫Well, is it true?
‫Did the password of the admin user really change?
‫So I go back to the browser.
‫Log out of the app and try to log in again using the admin admin credential.
‫Nope, no chance.
‫Just as we guessed, Zap has changed the password.
‫So let's try to log in with this our password.
‫And to show you the password I enter, I'll use a small trick.
‫Right click on the password field, select Inspect Element.
‫Changed the type of field as text.
‫Now, Ed, tap into the password field and click Login.
‫Yup.
‫Password of the admin user is app.
‫So how about a little summary?
‫What the heck happened during the spidering phase on the CSR page, Zab filled in the fields with Zaf
‫keyword.
‫There are two input fields on the CSR page new password and the confirmation of the new password since
‫they are the same.
‫It was a valid password changing request when Zap clicked submit on the page.
‫The password of the current user admin has changed when Zapp logged out of the app, for example, by
‫clicking the log out link, it tried to log in again.
‫But because the password is no longer admin, it failed to re log in and it was the end of the spidering
‫phase for authorized pages.
‫So a huge warning comes in here.
‫If you're testing the real application, you're always a potential threat to change or delete some important
‫values.
‫You have to be very careful.
‫And beyond that, you should include the critical pages from the automatic scans.
‫So let's reset the database of DV W-A so that the password of admin user will be admin again.
‫Click set up button and then click the Create Reset database button to recreate the database tables
‫of the DVD application with the default values.
‫Now, the password, if he had been user, is admin again.
‫So a log out of the app and re log in using admin had been values.
‫So to avoid the password changes on the next phases, I'll exclude the page which changes the password.
‫So find the XREF page, right click on it.
‫And even the exclude from submenu select scanner.
‫The URL is added to the exclude from scanner list.
‫So the scanner module will not visit this SRF page and is not changed the password.
‫So now we're ready for the active scan phase.
‫Right click the DVD subfolder from the Attack submenu, select active scan option for this time in the
‫Active Scan panel, select the user, which will be used during the scan context is already selected.
‫Click, Start, Scan and let the show begin.
‫So that scan took longer than an hour.
‫And depending on the network speed and the size of the application, this gear may take several hours.
‫So go to the Alerts tab you see the vulnerabilities found.
‫And as expected, there are several high severity vulnerabilities, such as path traversal as Q well
‫injection excess, but don't worry, we'll see them in detail.
‫Let's first analyze the path traversal alert.
‫As we said before, automated tools generate some false positives, so we should verify the findings
‫to see if the vulnerability really exists.
‫The request used to find the past reversal vulnerability is a get request here as a payload.
‫Now it seems out, tried to reach the password file under the, et cetera, folder.
‫And let's look at the response by clicking the Response tab.
‫And there you see, the body of the response contains the content of the password file.
‫And here are the users of the system which hosts the DVD application.
‫So if you double click an alert in the Alerts tab, you see the details of the finding here.
‫There's a long description of the vulnerability.
‫And here is a solution.
‫And these are the references to learn more about path traversal, and this is the attack parameter.
‫It's called payload.
‫This is the evidence of the finding found in the response body.