Application scanning and automation with ZAP
With the open-source ZAP you scan your own app manually and automatically, set up authenticated scanning, weed out false positives and move scanning into the CI pipeline.
Level 201 · 16 lessons · 14 practice labs
Lessons
Getting to know ZAP
- What ZAP is: an open-source application security scanner
- Manual explore and the HUD: recording as you browse
- Contexts: scope, technology and excluded URLs
- Passive scanning: findings without touching the traffic
- Short task: set up a context for the lab app and classify the passive alerts
Active scanning
- The spider and AJAX spider: crawling single-page apps
- Authenticated scanning: users, sessions and logged-in indicators
- Scan policies: strength, threshold and rule selection
- Weeding out false positives and alert filters
- Short task: run a full scan as a logged-in user and confirm the real findings
Automation
- ZAP scripting: authentication and custom rules
- API scanning from an OpenAPI definition
- The Automation Framework: repeatable scans from a YAML plan
- A baseline scan and threshold rules in the CI pipeline
- Reports: producing output developers can use
- Capstone: set up an authenticated ZAP scan for the lab app that runs in CI
Practice labs
- Set up a context and drop the noise: Set up a ZAP context for the lab app, exclude third-party addresses and show only the target remains in the site tree.
- Prioritise passive alerts: Sort the alerts from the passive scan by risk and confidence and fix the top three in code or configuration.
- A flaw found while browsing with the HUD: Browse the app with the HUD on, confirm by hand an alert that appears, prove it is real and fix it.
- Silence false positives with alert filters: Weed out false positives in the scan results with reasons, define alert filters and show only real findings remain in the next scan.
- A single-page app with the AJAX spider: Find the pages the classic spider misses with the AJAX spider and list the difference between the two crawls.
- An authenticated scan with a login indicator: Define a user and session, set a logged-in indicator and prove the scan finishes without losing the session.
- A scan policy: injection only: Create a policy that runs only injection rules at high strength and verify and fix the flaw it finds by hand.
- The logout-link trap in an authenticated scan: Detect that the scan clicks the logout link and loses its session, fix it with an exclusion rule and complete the full scan.
- A full authenticated scan with verified findings: Run a full scan as a logged-in user, verify each high finding by hand, fix the real ones and scan again.
- An API scan from an OpenAPI file: Load the lab API's OpenAPI file into ZAP, run the scan and group the findings by endpoint.
- A repeatable scan with a YAML plan: Write a YAML plan with context, spider, passive scan and report steps in the automation framework and run it twice for the same result.
- Authentication with a script: Write an authentication script for an app with token-based login and show ZAP sends logged-in requests.
- A baseline scan with a threshold rule in CI: Add a baseline ZAP scan to the pipeline on the lab Git server, set a threshold that fails the build on high findings and test it with a deliberate flaw.
- A ZAP report a developer can use: Produce a report template from raw ZAP output that merges duplicates, includes fix advice and leaves out needless alerts.
About this course
With the open-source ZAP you scan your own app manually and automatically, set up authenticated scanning, weed out false positives and move scanning into the CI pipeline.
What you will learn
- Getting to know ZAP
- Active scanning
- Automation
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.