OWASP ZAP w2021-01-11 released: pentesting tool for finding vulnerabilities in web applications
The OWASP Zed Attack Proxy (ZAP) is easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing as well as being a useful addition to an experienced pen testers toolbox.
ZAP provides automated scanners as well as a set of tools that allow you to find security vulnerabilities manually.
Some of ZAP’s features:
- Open source
- Cross-platform
- Easy to install (just requires java 1.7)
- Completely free (no paid for ‘Pro’ version)
- Ease of use a priority
- Comprehensive help pages
- Fully internationalized
- Translated into a dozen languages
- Community-based, with involvement, actively encouraged
- Under active development by an international team of volunteers
Some of ZAP’s functionality:
- Intercepting Proxy
- Traditional and AJAX spiders
- Automated scanner
- Passive scanner
- Forced browsing
- Fuzzer
- Dynamic SSL certificates
- Smartcard and Client Digital Certificates support
- Web sockets support
- Support for a wide range of scripting languages
- Plug-n-Hack support
- Authentication and session support
- Powerful REST-based API
- Automatic updating option
- Integrated and growing marketplace of add-ons
OWASP ZAP w2021-01-11 has been released.
Changelog
Some of the more significant enhancements include:
Custom Pages
Custom Pages can be defined on a per context basis – these allow ZAP to identify various non-standard error handling conditions such as custom error pages and handle them more effectively.
Authentication Polling
The concept of Authentication Verification Strategies has been introduced which allows ZAP to handle a wider range of authentication mechanisms including the option to poll a specified page for the authentication status of a user.
Site Tree Control
Scripts and add-ons now have full access to how nodes are represented in the Sites Tree. Both Input Vector Scripts and add-ons which include implementations of the Variant class can change both the tree structure and names used for new nodes.
For more details see the Site Tree Modifiers Blog post.
Dynamic Look and Feel including Dark Mode
The Desktop UI includes a new set of open source Look and Feel’s c/o FlatLaf including 2 Dark Mode options.
You can also dynamically switch the Look and Feel via a button on the Top Level Toolbar.For more details of the dark mode see the Dark Mode in the Weekly Release Blog post.
More…
OWASP ZAP Tutorial
