Zed Attack Proxy
summary
Zed Attack Proxy claims real capability not marketing: a free OSS proxy with 25,000 downloads and over 20 translations, built-in API for automated regression tests, an embeddable Zest scripting language to record, assert and reproduce attacks, and Plug-n-Hack phase two that injects client-side JS to monitor and fuzz postMessage. Demos show session/user switching, WebSocket support, and an automated fuzz that actually finds a DOM XSS, so the features work end to end.
AI-written summary · about
chapters (22)
- 0:00Intro
- 1:24What is ZAP? . An easy to use webapp pentest tool
- 2:34ZAP Principles
- 4:51Ohloh Statistics
- 5:48User Questionnaire
- 6:24The Main Features All the essentials for web application testing
- 6:49How can you use ZAP?
- 9:02Security Regression Tests
- 11:37Enhanced Sessions
- 11:53SAML 2.0
- 12:24CMS Scanner
- 12:36Dynamic actions
- 20:03Plug-n-Hack - Phase 1
- 20:53Scripting
- 24:55Zest - Overview
- 25:30Zest - Use cases
- 32:21Zest - Passive Scan Rule
- 40:24Zest - Statements
- 40:44Zest - Runtime
- 41:04Plug-n-Hack - Phase 2
- 46:49ZAP Hackathon!
- 47:37Conclusion
related talks
58mWhiz, Bang, ZAP! An introduction to OWASP's Zed Attack Proxy
35mAutomated Security Testing
12mOWASP ZAP HUD WTF?
27mHacking with a Heads Up Display
44mHack Yourself: Intro to pentesting with ZAP
58mOpen Source Pentesting and Security Analysis Tools: the DevOps way
59mZAP Project
47mOWASP ZAP: More Advanced Features