There's no doubt that no organization wants to be the victim of a cyber-attack; however, in practice, even the most security-minded organization can find itself caught off-guard or exposed when a zero-day exploit is discovered.

In addition, with the complexity of our systems (apps, networks, and websites) and increase in various vulnerabilities discovered daily, it's becoming harder and harder to stop them all. Despite our best security efforts, this can open the door to malicious users.

We don’t need to paint the horror story of what a cyber attack costs a company in business, trust, reputation, and much more - but it’s in the millions and billions of dollars at times, and many man hours to mitigate and remediate the attack. ‍

Today, we are much more well-positioned to overcome security challenges, with many excellent open-source security tools, knowledge, and awareness to support better security hygiene.  

One excellent tool that has been a game changer for simplifying security detection and ultimately remediation is OWASP ZAP (a tool we have spoken about many times and love). For those who haven’t read our previous posts (you should!). OWASP ZAP is an open-source community project that provides great out-of-the-box DAST for your web apps. 

In our previous posts, we provided some tutorials for getting started and testing permissions policy header configuration. This article will take you through all the steps to use OWASP ZAP for penetration testing to effectively protect your systems.  

Types of Security Testing

In our previous posts, we discussed the different kinds of scans available. In this post, we'll focus on the actual testing. As security continues to evolve, so too, do the methods used to test the security of systems and networks. Security testing is more necessary than ever to identify vulnerabilities and have a real-time understanding of the risks posed to your organization through its code and systems. This is where continuous security comes in.  

With the many diverse technologies in our stack, to stay ahead of would-be attackers, we can employ different types of scans and tests to get the most coverage for our stacks. Below are some of the most popular types of security testing:

• Vulnerability assessment: A vulnerability assessment analyzes a system or application to identify security risks. It is essential because it can help to prevent attacks by identifying and fixing security vulnerabilities. A vulnerability assessment can be used to safeguard a business by identifying potential security risks and taking steps to mitigate them.
• Penetration testing:  Penetration testing is a type of security testing that is used to assess the security of a computer system or network. It is used to find vulnerabilities that attackers could exploit.
• Runtime testing: Runtime testing is a process of testing software during its execution. This type of testing can reveal errors that may not be apparent during design or compilation.
• Code review: A code review is a process where code is inspected for potential errors, vulnerabilities, and compliance issues. It can be used to safeguard your business from malicious attacks by identifying and correcting errors and vulnerabilities before cyber attacks can exploit them. Code reviews can also help ensure compliance with industry and government regulations.

What is Penetration Testing?

The purpose of penetration testing is to identify security vulnerabilities that attackers could exploit to gain access to sensitive data or systems. It can help a business protect against bad actors by identifying security weaknesses and providing recommendations for improving the organization's security posture.

The 5 Penetration Testing Stages

‍

Phase 1: Planning and Reconnaissance

Planning and reconnaissance is the first step in penetration testing. It helps the tester understand the target environment and identify potential vulnerabilities. It also allows the tester to create a plan of attack and choose the appropriate tools and techniques for the test.

Phase 2: Scanning

The scanning stage is the process of identifying the systems and services that are running on a network. It allows the penetration tester to determine which systems are vulnerable and which are not. The scanning stage also allows the penetration tester to choose the best way to attack the systems on the network.

Phase 3: Gaining System Access

In this phase, the attacker tries to gain access to the system. This can be done by attempting to exploit vulnerabilities in the system, brute forcing passwords, or social engineering. This stage is crucial because it is when the attacker can gain access to the system and start to compromise it.

Phase 4: Persistent Access

The Persistent Access stage in penetration testing is where the attacker attempts to maintain access to the system after the initial compromise. Persistent Access can be done through some methods, such as installing a backdoor, setting up a persistent reverse shell, or adding a user to the system with elevated privileges. This stage allows the attacker to maintain a foothold on the system even if initial access is lost. This can impact your business by enabling the attacker to monitor your system continually and collect sensitive data or launch further attacks against other systems.

Phase 5: Analysis and Reporting

The analysis and reporting stage in penetration testing is when the pentester analyzes the data gathered during the assessment and creates a report detailing their findings. This stage allows the pentester to communicate their findings to the client to take appropriate action to mitigate any risks. It is also vital for businesses to understand the potential impact of any vulnerabilities found to make informed decisions about how to protect their systems.

Below we’ll dive into how you can leverage OWASP ZAP to automate this process and continuously run this process with minimal friction to have an ongoing understanding of the evolution of your security posture.

How to use OWASP ZAP for Penetration Testing

ZAP is short for Zed Attack Proxy, which is leveraged by many pentesters to find security vulnerabilities in web applications, understand and fix security issues, and maintain long-term security hygiene. It does this by creating a baseline security assessment of a web application, and helps ensure compliance with security standards and regulations.

Without further ado, let’s get started with the quick guide on how to use OWASP ZAP for penetration testing.

1. Installing ZAP

You can download the latest version from the OWASP ZAP website for your operating system to install ZAP or reference the ZAP docs for a more detailed installation guide.

‍

Once completed, follow the prompts to install OWASP ZAP on your machine.

2. Persisting a session

Persisting a session in OWASP ZAP means that the session will be saved and can be reopened at a later time. This is useful if you want to continue testing a website or application at a later time.

Once you’ve started OWASP ZAP, you will see a screen that looks like this:

The prompt gives two options to persist in the session. You can use the default to name the session based on the current timestamp or set your name and location.

Alternatively, you can persist a session by going to ‘File’ and choosing ‘Persist Session…’. Give your session a name and click on the ‘Save’ button.

3. Running an automated scan

Running an automated scan in OWASP ZAP is a way to check for common security vulnerabilities in web applications. This is done by sending requests to the application and analyzing the responses for signs of common vulnerabilities. It can help to find security issues early in the development process before they are exploited.

With OWASP ZAP, you can use a ZAP spider or the AJAX spider. So what’s the difference?

ZAP spider is a web crawler that can automatically find security vulnerabilities in web applications. Meanwhile, the AJAX spider is a web crawler designed to crawl and attack AJAX-based web applications.

Clicking on the ‘Tools’ option will give you a list of available pentesting tools provided by OWASP ZAP. 

To run an automated scan, you can use the quick start “Automated Scan” option under the “Quick Start” tab. Enter the URL of the site you want to scan in the “URL to attack” field, and then click “Attack!”.

4. Interpreting test results

Interpreting test results in OWASP ZAP is vital to understand the scan findings and determine which issues require further investigation. Additionally, it can help to prioritize remediation efforts.

In OWASP ZAP, you can view alerts by clicking on the "Alerts" tab. This tab will show you a list of all the alerts that have been triggered during your testing. The alerts are sorted by risk level, with the highest risk alerts at the top of the list. OWASP ZAP will give details of the discovered vulnerabilities and suggestions on how you can fix them.

5. Viewing alerts and alert details

Viewing alerts and alert details in OWASP ZAP is a way to see what potential security issues have been identified on a website. It can help security and administrators understand what needs to be fixed to improve the app's security. 

If you cannot find your ‘Alerts’ tab, you can access it via the ‘View’ menu, along with other options available in OWASP ZAP. Once you have your ‘Alerts’ tab, you can navigate the various vulnerabilities discovered and explore the reports generated by OWASP ZAP.

6. Exploring an application manually

Exploring an application manually in OWASP ZAP is a process of manually testing the application for security vulnerabilities. It is done to identify any potential security risks that may be present in the application. Doing this can help ensure that the application is as secure as possible.

The manual scan complements the automated scan by providing a more in-depth analysis of the application and allowing you to navigate the pentest process. The automated scan may miss some vulnerabilities, but the manual scan may pick up missed issues. However, the manual scan can be time-consuming and may not be feasible for large applications.

To explore an application manually, select “Manual Explore.” Select your browser, and OWASP ZAP will launch a proxy in your browser. Here, you will be given pentesting tools such as spiders, and if a vulnerability is discovered, an alert flag will be added to the alerts panel. 

Where to from here?

Having a developer perform a pentest with OWASP ZAP is one way to do a security audit. However, with anything manual, efficiency is often lost. This is where Jit comes in.

We know that pen testing is essential, but it can be cumbersome, mainly if your development team is already preoccupied with finishing features and needs to release the next cycle of updates for your applications. In addition to this, OWASP ZAP only covers one part of the pipeline.  

With Jit, your team can quickly assess all the security knowledge and tools needed to identify areas for improvement across all stages of the development process. Security doesn’t have to be the last port or forgotten thought. It doesn’t matter where in the pipeline; Jit has you and your team covered for all things continuous security get started today.