Whiz, Bang, ZAP! An introduction to OWASP's Zed Attack Proxy
Talkat AppSec California 2014 · on Monday, 2014-01-27· at 14:45· Track 3, Annenberg Community Beach House, East Pacific Coast Highway·
summary
Claims parity with AppScan and WebInspect but free open source, Zed Attack Proxy actually runs as a local Java proxy, records traffic, spiders (including an AJAX spider that launches browsers), fuzzes parameters, force‑browse directories, and intercepts responses with breakpoints to catch sensitive values. It ships modules via a marketplace, exposes an automation API and Zest scripting for CI, reports numerous findings during the demo, and supports WebSocket inspection and session/context handling.
AI-written summary · about
chapters (22)
- 0:00Intro
- 2:40The Goal
- 4:15About Me
- 5:45Who is ZAP for
- 7:40Demo
- 8:15Apps
- 10:10Documentation
- 12:10Installing ZAP
- 13:40Getting started with ZAP
- 17:00Using ZAP
- 19:30Logging in
- 22:05Scanning the site
- 23:50Contexts
- 26:10Context
- 27:50Fuzzing
- 29:45Can Tests
- 30:40The Marketplace
- 36:05Conclusion
- 38:35QA
- 40:35Zest
- 46:35Breakpoints
- 53:05Scripting
related talks
51mZed Attack Proxy
12mOWASP ZAP HUD WTF?
35mAutomated Security Testing
27mHacking with a Heads Up Display
45mSecurity Testing with OWASP ZAP in CI/CD
33mAutomated Security Scanning in Payment Card Industry
21mAutomated Security Scanning in Payment Card Industry
40mEvolution of AppSec: Perspectives from a Decade of Building OWASP ZAP