-
-Webpage:http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project -
The .jar install file can be found at the OWASP Sourceforge Page
-Below is a list of tools we've found useful in solving the WebGoat lessons. You will need WebScarab or Paros to solve most of the lessons.
-
-Like WebGoat, WebScarab is a part of OWASP.
-WebScarab is a proxy for analyzing applications that
-communicate using the HTTP and HTTPS protocols. Because WebScarab
-operates as an intercepting proxy, we can review and modify requests
-and responses.
-
-Webpage:http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project
-
The .jar install file can be found at the OWASP Sourceforge Page
After installing WebScarab and configuring your browser to use it as proxy on localhost we can start. If you are using localhost for your Tomcat server, remember to put a "." after the hostname when browsing to WebGoat.
-
-We have to select "Intercept Request" in the tab "Intercept". If we send a HTTP request we get a new WebScarab window.
-
-Here we can read and edit the intercepted parameter. After "Accept changes" the request will be sent to the server.
-WebScarab is also used to intercept the request and change cookies values just like parameter data:
-
-We get a new window on sending a HTTP request. On the screenshot you see where we can find cookies and how to edit their values.
+Like WebGoat, Zed Attack Proxy (ZAP) is a part of OWASP and is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications.
+It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing.
+ZAP provides automated scanners as well as a set of tools that allow you to find security vulnerabilities manually..
+
+Webpage: https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project
+
The .jar install file can be found at the OWASP ZAP Google Code Project
After installing ZAP and configuring your browser to use it as a proxy on localhost we can start. To intercept a request,
+click the green arrow icon turning it red. If we browse a WebGoat page, ZAP will intercept the HTTP request.
+Here we can read and edit the intercepted parameters and headers. After editing is complete press the play icon to submit the request to the server.
+
-Firebug is an add-on for the Firefox browser. We can use it to inspect, edit and monitor CSS, HTML and JavaScript.
-
-Webpage:http://www.getfirebug.com
+Most modern browser have developer tools that will allow you to inspect and modify request data.
-
-IEWatch is a tool to analyze HTTP and HTML for users of the Internet Explorer.
-
-Webpage:http://www.iewatch.com
-
Wireshark is a network protocol analyzer. You can sniff network traffic and gather useful @@ -43,11 +30,12 @@ Webpage:http://www.wireshark.
-
-There are many vulnerability scanners for your own web applications. They can find XSS, Injection Flaws and other vulnerabilities. Below are links to two open source scanner.
+There are many vulnerability scanners for your own web applications. They can find XSS, Injection Flaws and other vulnerabilities. Below are links to three open source scanners.
Nessus:http://www.nessus.org
Paros:http://www.parosproxy.org
+OWASP ZAP:https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project