Hacking with a Heads Up Display
summary
A browser-integrated front end for OWASP ZAP overlays the app and runs site tree, spider, passive + active scanners and an intercept/break tool so scanning, replay and exploitation happen without switching apps. The HUD actively sends dozens of payloads, surfaces growler alerts, locates XSS and annotates vulnerable forms, lets intercepts produce a negative-price checkout, and loads custom scripts (Zest/JS/Python/Ruby) via ZAP’s REST API to add tools in <2 minutes. Architecture uses a ZAP plugin that injects JS and iframes and talks to ZAP by service worker + REST, enabling intercept & replay in-browser.
AI-written summary · about
chapters (6)
related talks
29mZAP Heads Up Display
12mOWASP ZAP HUD WTF?
58mWhiz, Bang, ZAP! An introduction to OWASP's Zed Attack Proxy
44mHack Yourself: Intro to pentesting with ZAP
36mLet's take baby steps to security testing
59mZAP Project
45mSecurity Testing with OWASP ZAP in CI/CD
40mEvolution of AppSec: Perspectives from a Decade of Building OWASP ZAP