ZAP Running The Scan

1. Adding a site to the testing scope

By telling ZAP what the target site is, ZAP can limit the scope of the scan and only scan the target site for vulnerabilities.

1. Open the web application that you want to test.
2. In Zap you will find your website/application is displayed under sites.
3. To add your site to the scope of the test, right click on the target address and select Include in Context>New Context. This will tell ZAP to perform scans only on this particular site and ignore all other requests and responses.

4. Choose a suitable name and set it as a context name (Eg: testfire)

5. If your application has multiple sites you can add all of them by right clicking on the URL and selecting “Include in Context”>”TestFire”

2. User Log Out detection

While ZAP is performing scans on the target sites, the session might become invalidated (ZAP may have visited the logout link or the session may have timed out). To make sure ZAP always has an active session to scan, we need to use the logout detection capability of ZAP.

1. Log in to your application
2. Click on the logout link
3. In Zap, navigate to the page which invokes the logout request. Right click and select “Exclude from” > “Scanner”. Click OK.

9. Again right click on the same link and select “Exclude from” > “Spider”

10. Optionally you may identify part of the page source which signifies that a user has logged out. For example in the testfire website, a “Sign in” link is shown only when the user is not authenticated or when the user is logged out.

11. Find the part of the response in ZAP where the “Sign in” text is displayed. Right click on the source code and select “Flag as Context”> “TestFire: Authentication Logged out indicator”. Click “Ok”.

                

3. User Auto-login if logged out (Only for applications with form based authentication)

If user does get logged out during the course of testing, ZAP can automatically log back in so that it can continue with the tests. This functionality only works if your application has form based authentication.

1. Log in to your application
2. Check for the request that was sent when the application was authenticated (logged in). Right click on the request select “Flag as Context” > “TestFire: Form-based Auth Login request”

14. In the session properties dialog that pops up make sure the Login URL is the same login URL of the application and the POST data is in the textbox. Make sure the username and password parameters are correct by selecting the appropriate username and password parameters from the list.

15. In the left side bar click “Users” in the left side bar.
16. Click Add
17. Enter the username and password that your application uses

18. Click add.
19. Now click on  “Forced User” in the left bar. This tells ZAP which credentials to use if the user is logged out. You can optionally configure multiple users for the same application, but ZAP will only use the user you chose as “Forced User”
20. Make sure the user you have added is selected. Click OK
21. If Forced User is configured and logged-out indicator is added, a new button should appear at the top called “Forced User Mode”

22. Click on it to enable it. By enabling this option, the user is logged back in as soon as ZAP finds out that the user has been logged out.
23. Go to your application and try to log out. If auto-login is configured correctly, you will get automatically logged back in.

4. Starting the Spider

By using the Spider, ZAP will try to build up a detailed site map of your target application. ZAP tries to find each and every link, therefore its important to tell ZAP about the all the use cases before starting the spider.

1. Once the above steps are done. You are ready to start the spider.
2. Go through all the use cases of your application while still proxying through zap.
3. In Zap, right click on your application website in left sidebar. Choose Attack>Spider all in Scope

27. You will see the progress in the below Spider tab.
28. Wait for the spider to be 100% complete. You can see the links found by ZAP in the left side bar.

5. Starting the Scanner

By running the scanner, ZAP will try to find vulnerabilities in your application by performing various attacks. Its important to finish spidering before starting the scanner.

1. Please make sure the spider is complete before starting the scanner
2. Make sure the user is logged in (Or make sure auto-login is working fine)
3. In Zap, right click on your application website in the left sidebar. Choose Attack>Spider all in Scope

32. The scan might take anywhere from 5 minutes to a few hours depending on the size of your application. Please keep checking on your application (to which the proxy is hooked up) to make sure the user is still logged in and also that the site is still up.
33. Once the scan is complete, you will find the results in the alerts tab

6. Downloading the Report

1. Extract the report by going to Report > Generate HTML report