Download as PDF, PPTX
Uploaded byThinqloud
Security Testing using ZAP in SFDC
ZAP is an open-source web application security scanner that can identify security vulnerabilities. It works as a proxy to intercept web traffic and modify requests during security tests. Key features include automated scanning, fuzzing, and generating reports with risk levels. The document provides steps to install ZAP, configure certificates to allow HTTPS scanning, and use ZAP to analyze a Salesforce org or other web application for issues like exposed session IDs or missing security headers.
More Related Content
Similar to Security Testing using ZAP in SFDC
![Zed attack proxy [ What is ZAP(Zed Attack Proxy)? ]](https://cdn.slidesharecdn.com/ss_thumbnails/zedattackproxy-171001165040-thumbnail.jpg?width=640&height=640&fit=bounds)
Security Testing using ZAP in SFDC
- 1. SECURITY TESTING USINGZAP IN SFDC -MUSTAFAJHABUAWALA
- 2. Overview • What isZAP ? • Introduction • Features • Benefits of Security Testing using ZAP • Installation • Troubleshooting Errors • How to use ZAP • Report analysis
- 3. What is ZAP? • OWASP ZAP (short for Zed Attack Proxy) • The Zed Attack Proxy (ZAP) is penetration testing tool for finding vulnerabilities in web applications • Web application security scanner
- 4. Introduction to ZAP •Open-Source web application security scanner • Intended to be used by both those new to application security as well as professional penetration testers. • When used as a proxy server it allows the user to manipulate all of the traffic that passes through it, including traffic using https. • This cross-platform tool is written in Java and is available in all of the popular operating systems including Microsoft Windows, Linux and Mac OS X.
- 5. Introduction to ZAP •ZAP can be configured as a proxy. • ZAP records the traffic and use that traffic for a replay attack while modifying the request parameters
- 6. Features of ZAP •Intercepting Proxy • Automated Scanner • Passive Scanner • Brute Force Scanner • Fuzzer • Port Scanner • Spider • Web Sockets • REST API
- 7. Benefits of SecurityTesting using ZAP • Identify issues and problems with the implementation of business security policies. • Better coverage over the entire code base. • Improvement in the quality of the application before going live. • Report will have the complete information, so no experts are required. • Does not affect the QA schedule or activities.
- 8. Installation of ZAP •Download Link: • https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project
- 9. Double click onthe installation file which you have downloaded and follow below steps 1. Accept the license agreement and click Next to continue 2. Browse to local directory where you want to store the program files for ZAP 3. Select appropriate options and click next to continue 4. To confirm click on Install to proceed further 3 4 1 2
- 10. 5. To confirmclick on Install to proceed further 6. Successfully Installed.. Click finish 7. Double click on the OWASP ZAP icon and accept the license 7 65
- 11. Installing Certificates • Sinceall requests and responses are proxied by ZAP, the certificate verification will fail for sites using SSL (HTTPS) and the connection will be terminated. • To prevent this from happening, ZAP generates an SSL certificate for each host, signed by its own Certificate Authority (CA) certificate. • This CA certificate is generated the first time ZAP is run, and is stored locally. • To use the ZAP Proxy with these websites, you will need to install ZAP’s CA certificate as a trusted root in your browser.
- 12. Click on Tools– Options – Dynamic SSL Certificates
- 13.
- 14. Browse to localdirectorywhereyou want to store certificate
- 15. Click on Import(whichwill import yourlatest certificatein ZAP registry), clickyes to overwrite the certificate
- 16. Browse to thelocationwhere certificateis locatedandclick on Open
- 17. Now you aredone with Generating andImporting certificates,click onOK
- 18.
- 19.
- 20.
- 21.
- 22. YOU ARE DONE You have successfully installed and configured ZAP tool
- 23.
- 24.
- 25.
- 26. HOW TO USEZAP ?
- 27. How to UseZAP ? • Once you have configured certificates and port in your browser • Enter the URL in browser on which you want to perform security testing, ZAP will start analyzing the site • URL can be your SFDC ORG link, or a Visual force page link, lightning page link, it can be any link
- 28.
- 29.
- 30.
- 31. Generating Reports • Reportsgenerated by ZAP contains different risk levels • High • Medium • Low • Informational • Details with description, URL, Solution will be mentioned in report by ZAP • Sample errors are as follows • Session ID in URL Rewrite • X-Frame-Options Header Not Set • Referrer Exposes Session ID • Application Error Disclosure and many others..
- 32.
- 33.
- 34.
- 35.