{"id":2026,"date":"2013-01-30T15:16:09","date_gmt":"2013-01-30T18:16:09","guid":{"rendered":"http:\/\/www.talsoft.com.ar\/?p=2026"},"modified":"2013-01-30T15:16:09","modified_gmt":"2013-01-30T18:16:09","slug":"owasp-zed-attack-proxy-v-2-0-0","status":"publish","type":"post","link":"https:\/\/www.talsoft-security.com\/site\/owasp-zed-attack-proxy-v-2-0-0\/","title":{"rendered":"OWASP Zed Attack Proxy v 2.0.0"},"content":{"rendered":"

There is a new version of the OWASP Zed Attack Proxy (ZAP) available right now, and there are so many changes in it that we\u2019ve decided to call it version 2.0.0.<\/p>\n

If you just want to get stuck in and download it then head over tohttp:\/\/code.google.com\/p\/zaproxy\/downloads\/list<\/a>\u00a0: it’s available for Windows, Linux and Mac OS.<\/p>\n

(Note that the Mac OS specific release is coming soon, but the Linux release is actually cross platform and will work fine on Macs)<\/p>\n

And if you want to learn a bit more about the changes then read on…<\/p>\n

We can only cover the new features at a high level in one blog post, but the plan is to host a Google hangout demonstrating many of these features at 17:00 UTC on Friday 8th Feb. Details to be announced via\u00a0https:\/\/twitter.com\/zaproxy<\/a><\/p>\n

Simon will also be presenting a talk at FOSDEM on Feb 2nd:\u00a0Practical Security for developers, using OWASP ZAP<\/a><\/p>\n

New features<\/h3>\n

An integrated add-ons marketplace<\/p>\n

ZAP can be extended by add-ons that have full access to all of the ZAP internals. Anyone can write add-ons and upload them to the ZAP Add-on Marketplace (OK, so its a Google code project called zap-extensions, but you get the idea).<\/div>\n
More importantly you can now browse, download and install those add-ons from within ZAP. Most add-ons can be dynamically installed (and uninstalled) so you wont even need a restart.<\/div>\n
You can choose to be notified of updates, and even be automatically updated. And as the scan rules are now implemented as add-ons you can get the latest rules as soon as they are published.<\/div>\n

A replacement for the ‘standard’ Spider<\/p>\n

The \u2018old\u2019 Spider was showing its age, so its been completely rewritten, and is much faster and more comprehensive than the old one. This is still a ‘traditional’ spider that analyses the HTML code for any links it can find.<\/div>\n

A new ‘Ajax’ spider<\/p>\n

In addition to the ‘traditional’ spider we’ve added an Ajax spider which is more effective with applications that make heavy use of JavaScript. This uses the\u00a0Crawljax<\/a>\u00a0project which drives a browser (using\u00a0Selenium<\/a>) and so can discover any links an application generates, even ones generated client side.<\/div>\n

Web Socket support<\/p>\n

ZAP now supports WebSockets, so ZAP can now see all WebSocket messages sent to and from your browser. As with HTTP based messages, ZAP can also intercept WebSocket messages and allows you to change them on the fly.<\/div>\n
You can also fuzz WebSockets messages as well using all of the fuzzing payloads included in ZAP from projects like JBroFuzz and fuzzdb. And of course you can easily add your own fuzzing files.<\/div>\n

Quick Start tab<\/p>\n

The first main tab you will now see is a \u2018Quick Start\u2019 tab which allows you to just type in a URL and scan it with one click.<\/div>\n
This is an ideal starting point for people new to application security, but experts can easily remove it if they find it distracting.<\/div>\n

Session awareness<\/p>\n

ZAP is now session aware, so it can recognise and keep track of multiple sessions. It allows you to create new sessions, switch between them, and applies to all of the other components, like the Spider and Active Scanner.<\/div>\n

User defined Contexts<\/p>\n

You can now define any number of \u2018contexts\u2019 – related sets of URLs which make up an application. You can then target all URLs in a context, for example using the Spider or Active Scanner. You can also add the contexts to the scope, and associate other information, such as authentication details.<\/div>\n

Session scope<\/p>\n

The session scope allows you to specify which contexts you are interested at any one time. You can restrict what you see in various tabs to just the URLs in scope, and prevent accidentally attacking URLs not in scope by using the Protected mode.<\/div>\n

Different modes<\/p>\n

ZAP now supports 3 modes:<\/div>\n