Monday, August 20, 2012

WebApps Pentesting with ZAP and its AJAX Spider Plugin

We recently developed a new plugin for ZAProxy that integrates a web spider called Crawljax, which is an open source Java spider of AJAX web applications.

By using the AJAX Spider plugin, we can discover the pages and dynamic-built links of a targeted web application, whose results can be later used by ZAP to find its vulnerabilities.

To set up the plugin, you have to perform the three following steps:
  1. Download the last release of ZAP from the zaproxy downloads tab. It is required ZAP>=1.4.1. 
  2. Download the AJAX Spider plugin from the zap-extensions site.
  3. Put the extension in the plugin folder of ZAP.
After this, ZAP and the AJAX Spider are ready to run. The AJAX Spider plugin can be invoked in the attack menu of the Sites Tab, as shown in [1] of the following image. The results of the crawling process will be shown in the AJAX Spider tab [2].


There are some parameters that you might want to configure before running it regarding the local proxy that ZAP creates to communicate with the crawljax instance, and regarding the crawling process:
  • In the local proxy options[1], you can configure its port an IP address.
  • In the crawler options[2], you can choose the web browser to be used by the plugin, the number of threads and the browser windows to open. You can also activate the "scan in depth option", which slows down a bit the process but improves its final results.
 This is shown in the next image:



When the process is started, a set of windows will be opened and the results will appear in the Sites tab[1] and also in the Spider Tab[2] where the found URLs can be clicked and the HTTP request and response will appear in [3].



I made a brief video that shows how to crawl a site and later use the generated web tree to find vulnerabilities in the targeted web application by using ZAP.



The plugin is still in alpha phase, if you have any comment, suggestion or question do no hesitate to contact me or to open a thread in the ZAP users' group.

30 comments:

  1. Are there any plans to provide support for Safari Browsers .

    ReplyDelete
  2. @Anonymous: not in the near future. However, if you happen not to have chrome or firefox available, you can still use the htmlunit browser, which comes with the spider package.

    ReplyDelete
  3. Wow! It is a completely different topic. Great choice of Topic! You can apply for a Turkey visa online. You can get your Turkey Visa in just 1 hour by selecting the express processing type. It only takes 5 minutes to apply for an electronic visa Turkey. Apply Online.

    ReplyDelete
  4. I think this is one of the most important pieces of information for me. Thanks a lot for posting.. What is FRRO Form C? The C-Form mechanism helps the authorities to locate and track foreigners in India to enhance safety & security. You can read info about FRRO Form C via India evisas guide.

    ReplyDelete
  5. I am happy to see your work. Some additional charges may apply in case of emergency in India visa fees.

    ReplyDelete

  6. This is incredibly useful information. This article actually inspires me to follow your lead. When you are considering a trip to India, I need an India tourist visa covid, I read about this website and decided to use it. It's really good you can apply for your Indian visa online. In just a few days, I got my tourist visa to India online. When there were errors, they helped and understood the situation.

    ReplyDelete
  7. Hello, I wanted to write a little Info related to Visa. Are you interested in traveling to any country? Yes, you can evisa apply online. You can fill out your visa application form online within 5 to 10 minutes via our Visacent website. We offer visas to citizens of over 190 countries. You can read more info about visas via our website.

    ReplyDelete
  8. You are sharing a wonderful article with your audience. Readers are already enjoying it. I am here to inform the travelers who are willing to visit Turkey that they need to fill a Turkey visa application to enter Turkey. Online process makes makes easy to get evisa.

    ReplyDelete
  9. That is the same thing that I am trying to find. Thanks for sharing this information… keep it up The process of e visa Turkey is easy and simple, the application form of Turkey evisa is easy to fill out for everyone, if you want to apply for a visa check out the page.

    ReplyDelete
  10. Directory For PlacesMarch 16, 2023 at 11:14 AM


    A business guide provides information and guidance on various aspects of business management and ownership.

    ReplyDelete

  11. This way you can get a lot of information. Keep researching and reviewing.

    ReplyDelete
  12. I discovered a lot of useful information in your article. Visa Free Countries For New Zealand Citizens. New Zealand citizens are fortunate to possess a passport that opens doors to a wide range of visa-free countries around the world. This remarkable privilege allows Kiwis to explore the globe with exceptional ease and convenience.

    ReplyDelete
  13. VFS Global is a global visa and passport processing service provider. Visit www vfsglobal com Saudi arabia for information on services, appointments, and requirements related to Saudi Arabia's visa and consular services.

    ReplyDelete
  14. Hello! Your ongoing support is truly invaluable, driving us to craft increasingly captivating content. We appreciate you being our muse and motivating force, inspiring us to persist in our creative endeavors. Thank you! Experience the convenience of the eVisa to Moscow. Simplify your travel with easy online application, swift processing, and explore the vibrant Russian capital hassle-free.

    ReplyDelete
  15. You're absolutely amazing! 😃 I don't think I've come across anything quite like this before. 🤩 It's fantastic to discover someone with such unique ideas on this subject. 🌟 Thank you so much for initiating this, and your website is truly a valuable addition to the internet. 🌐 We need more individuals like you who bring originality to the table! 🙌👏

    ReplyDelete
  16. I appreciate your openness in sharing these insights with us. In the coming days, I'll certainly be joining the event as this subject matter greatly piques my interest. Kindly click on the link for additional information I'd like to share. Top 5 Shopping Malls of Istanbul, Istanbul boasts a vibrant shopping scene, and these top 5 shopping malls offer a diverse retail experience. Explore the grandeur of the Grand Bazaar, shop for luxury brands at Istinye Park, or enjoy modern retail therapy at the Forum Istanbul and Akasya Acibadem malls.

    ReplyDelete
  17. I find your blog incredibly delightful! The way you fuse insightful information with a concise and articulate writing style is truly impressive. I'm genuinely amazed by the thoroughness of your analysis and how effortlessly you unravel complex ideas. I eagerly await your future content, confident it will continue to enlighten and captivate with its brilliance.

    ReplyDelete
  18. "While this may not be directly related, I'm considering the idea of starting my own blog, and I have questions about the setup. It seems that managing a blog like yours might require a substantial investment. Since I'm not well-versed in web-related matters, I'm not entirely sure. Any advice or suggestions you could offer would be highly valued."

    ReplyDelete
  19. The Kenya eTA system streamlines entry for eligible travelers. Obtain authorization online, ensuring a smooth and efficient process.Kenya eTA System
    Learn about application requirements and guidelines for a seamless travel experience.

    ReplyDelete
  20. I'm a consistent blogger, and your content is something I highly appreciate. This great article has caught my attention. I've bookmarked your site and will be checking for updates approximately once a week. I've also chosen to receive your RSS feed.Discover essential Kenya Online eTA Frequently Asked Questions in 30 words. Gain insights into the electronic travel authorization process, requirements, and application details. Start your journey with these key FAQs.

    ReplyDelete
  21. Your perspectives gracefully traverse the complex realm of [blog post topic]. The articulate expression in your writing captivates readers, maintaining their interest throughout. The seamless integration of information and personal insights brings a unique depth to the story. Anticipating more stimulating content that challenges traditional norms. Well done on producing a piece that ignites both intellect and inquisitiveness

    ReplyDelete
  22. This intriguing blog entry presents an original viewpoint on a commonly disregarded subject. The author's polished prose seamlessly transports readers into a realm of curiosity and contemplation. Each passage unfurls like a finely tuned melody, blending thoughts and emotions harmoniously. Through this perspective, everyday occurrences take on deeper meanings, leaving readers both enlightened and invigorated.

    ReplyDelete