ZAP Heads Up Display

on YouTube ↗29m

" summary

ZAP adds an in‑browser Heads Up Display that overlays live tooling on pages and injects JS and iframes to show scope, site tree, alerts and history; it uses the ZAP API plus WebSockets and stores HUD state in IndexedDB. Intercept/edit/replay, attack mode fuzzing and passive scanning run in real time (demo finds a SQLi in Juice Shop). A ServiceWorker mediates cross‑frame messages and isolates HUD from page scripts. Extensible via user scripts (example: replace “budget” with “hacking”); core team of four; aiming for a November release.

AI-written summary · about

" chapters (10)

1. 0:00Introduction
2. 5:55Demo
3. 10:57Show Enable Hidden Fields
4. 11:47Attack Mode
5. 13:35Page Alert Icons
6. 15:05Scripting
7. 17:25SAP API
8. 20:15How it Works
9. 21:19Source Code
10. 22:17Service Worker

" related talks

• 27mHacking with a Heads Up DisplayDavid Scrobonia · BSidesSF 2019
• 12mOWASP ZAP HUD WTF?Robin Minto · NDC London 2020
• 59mZAP ProjectSimon Bennetts · OWASP 2022 Global AppSec Europe Virtual Event
• 58mWhiz, Bang, ZAP! An introduction to OWASP's Zed Attack ProxyBen Walther · AppSec California 2014
• 44mHack Yourself: Intro to pentesting with ZAPMike Lehan · Dutch PHP Conference 2024
• 41mHow Scripting In ZAP Can Bridge The Gap Between Dev Teams And SecurityPeter Hauschulz · OWASP Global AppSec Amsterdam 2019
• 35mAutomated Security TestingAlan Parkinson · SeleniumConf 2012 London
• 36mLet's take baby steps to security testingChristina Thalayasingam · SeleniumConf London 2019