Hack Yourself: Intro to pentesting with ZAP

on YouTube ↗44m

" summary

Live demo uses OWASP ZAP against the Juice Shop to show concrete results: an automated scan discovers a confidential FTP_acquisition.md, the proxy reveals an exploitable SQL injection that unions to dump the users table, a fuzzer finds the admin password "admin123", forced browsing exposes a JWT public key and package.json via path traversal, fuzzing a form parameter provokes a 500 and discloses a Handlebars view, and attack mode generates hundreds of junk requests and phantom accounts.

AI-written summary · about

" chapters (12)

1. 0:00Intro to hacking yourself
2. 1:49Why ZAP for pentesting
3. 3:55Juice Shop setup
4. 5:20Automated scan with ZAP
5. 11:38ZAP as intercepting proxy
6. 15:29SQL injection findings
7. 23:37Password brute-forcing
8. 28:58Form parameter exploits
9. 34:14Forced browsing discovery
10. 37:02Open redirect flaws
11. 40:14ZAP attack mode
12. 42:00ZAP features summary

" related talks

• 57mEnterprise Ethical Hacking Cloud ApplicationsRohit Bhardwaj · Developer Summit 2020
• 47mLive Hacking: Breaking into Your Web AppBrian Vermeer · Heapcon 2019
• 58mOpen Source Pentesting and Security Analysis Tools: the DevOps wayChristian Nils Schneider · DevOpsCon Spring 2019
• 01h 27mProactive Defense: Leveraging Hacker Tools for Early Vulnerability DetectionTobit Lill · code.talks 2023
• 48mHacking the Juice ShopCecilia Wirén · NDC Security 2023
• 24mFlagship Projects: Juice ShopBjörn Kimminich · OWASP 20th Anniversary 2021
• 27mHacking with a Heads Up DisplayDavid Scrobonia · BSidesSF 2019
• 36mLet's take baby steps to security testingChristina Thalayasingam · SeleniumConf London 2019