OWASP – ZAP

ZAP is an easy-to–use, integrated Penetration Testing tool for finding the vulnerabilities in web applications. We provided a brief overview of how to use ZAP in Chapter 3 regarding scanning a target for possible vulnerabilities. Let's revisit ZAP for identifying and exploiting cross-site scripting (commonly referred to as XSS) vulnerabilities.

ZAP comes built into Kali Linux 1.0, and can be found under Sniffing/Spoofing | Web Sniffers and selecting Owasp - ZAP, or simply opening a terminal window and typing in zap, as shown in the following example:

Here is a summary of setting up ZAP with Firefox, as explained in Chapter 3:

1. Accept the user agreement.

2. Generate an SSL certificate or import an existing one.

3. Import the certificate into a web browser such as Firefox by going to Preferences | Advanced and selecting the Encryption subtab.

4. Click on View Certificates and import the certificate.

5. Check all the trust options for using the new certificate.

6. Setup your Internet browser to use ZAP...