TryHackMe Introduction to OWASP ZAP Walkthrough

Hello and welcome back to RedBlue Labs.

Today's video is going to be a little bit

different than the ones I've done in the

past, where I'm actually going to be

doing a walkthrough on a TryHackMe

room. The room of choice for me today is

actually "Introduction to OWASP Zap," and I

chose this room because I personally

really enjoy ZAP. I like

the features that it has, and when I

had this paragraph here,

apparently the person who made this

room prefers it over Burp. And honestly,

it's a personal preference kind

of thing. Many, many people use Burp. Some

people use ZAP. I'm one of those people

that uses ZAP regularly.

Just a heads up, I do plan on editing

this video, so it's going to be

fairly fluid as I walk through

things. So there you go. Now you know.

If you're not familiar with

what ZAP is, it's a proxy where you have

your browser pointing to a proxy server

that's running locally, so maybe on your

Kali machine, and then you will

go onto the website. So, you're sending

traffic through the proxy over the

website, and the website is going to

go through the proxy back to you. So,

you've got like a person in the middle

that's handling that traffic, and then

while that traffic's being handled, you

can actually manipulate the data.

So, let's go ahead and start our room. Oh, I

got to join the room. And start that

machine.

And we're going to start off with the

first one. So, ZAP stands for

Zed Attack Proxy.

Woo.

Day 148.

So let's see if I can do that right now.

Still waiting 18 seconds.

Task 1 is done.

Go to task 2.

ZAP is a great tool that's totally slept

on. You know, that is

totally true.

Go ahead and give this section a read.

I've read the task.

Installation.

Okay, so I've actually already gone ahead

and done that.

There's a couple of ways you can

do it. They've got the the tool right

here. So,

pretty straightforward. Just go to the

website, and connect it into your Kali,

and go ahead and just download it. I

already have it installed, so that's

easy to

complete,

and then open it up.

Let's go over my machine,

and I'm going to

open it up.

Hit the Windows button or the Command

button, ZAP,

power it on.

Eventually, your ZAP will turn on, and you

are ready to proceed with the rest of

the room.

Let's go check out task 4,

and this task looks like we're doing

an automated scan. Let's go

ahead and run the command that it's

asking for.

Set up the Ajax spider. Looks like in

task 5, we are actually going to be doing

some manual scanning and we need to have

our browser pointing to our ZAP proxy.

So, there's a number of steps

to do this, and actually,

what will make this easier is in the

dropdown that you see right now, I

actually have a video that I've made

where

I actually go through this entire

process. So, I'm going to skip ahead, and if

you already have this set up, then that's

great. Or, if you want to watch that video

that I've made, go ahead and do that.

What IP do we use for the proxy? Well, we

would be pointing it to ourselves. So,

that could be localhost or a bit--it's

this one right over here. Bingo bango.

With task 6, it looks like we are

scanning an authenticated web

application. So,

in THM here, they give us some

credentials that we need to use on the

machine that they've got for us. So, let's

go down and give the page here a read,

and we are going to

open up our browser on our Kali machine

here.

And here we go. We've got our

spot here

to authenticate.

They're going to put in the credentials

that TryHackMe has given me

and authenticate. Let's go back and take

a peek at the instructions here.

Looks like we have or on the page that

we need to be, and we need to go down to

DVWA security

as instructed.

And I just want to do a double check here,

navigate to that tab and set the

security level to low and then hit

submit.

And after that, we're going to pass our

authentication token into ZAP so that we

can use the tool to scan authenticated

pages. Great.

Let's do that.

Low

and submit.

Okay,

so we are going to open up the inspector

here.

Go to storage,

and I'm going to grab the session key

cookie here.

And in ZAP, open the HTTP Sessions tab with the new

tab button, which is that one there, and

set the authenticated session to

active. You might actually notice a

slight disconnect between what you're

seeing in the PHP session right now and

what you saw about ten seconds earlier.

They do look different. And the reason

for that is because I actually

rerecorded doing this particular task,

and I wanted to make it pretty

straightforward to see how we can see in

ZAP the exact same session compared

to the session that we can see in the

inspector of the browser. So, that's what

you're seeing on the screen right now.

Because we have an authenticated session

in our

ZAP here, we're able to actually do a

scan against our target and receive a

lot more information because we now,

at this point, have an authentication

on the target.

Alright, so that was task 6, and now

we're moving on to task 7, which is

brute-force directories. Let's open up

the challenge and take a look at what

are the requirements here.

And so, essentially, we can actually use

word lists

and ZAP to do some brute-forcing to

figure out what kind of directories,

some directory enumeration that are on

the web server. Let's go down. And when we

have our sites here, when we do a

right-click and we do a forced browse

site, we can actually do this, do

directory enumeration. I actually have

another video where I do the exact same

thing. So, you can see that in the dropdown

as well if you want to be able to

specifically watch that. But we're going

to do the exact same thing here, and it's

pretty straightforward. Let's go

ahead and

do a

forced browse on our target system here.

And then we just have to pick the

list that we want. So, I'll use

this one.

But really, word lists are all over the

place. You can use whatever word list

works best for you.

And hit play.

Task 6 or task 7 complete.

Okay, task 8. Let's check out

what we've got here for brute-force web

login.

So, just like with the brute-force

directories, we can actually use Hydra

for this as well. But what we're doing in

this room is demonstrating that we can

use ZAP to do some of the similar tasks

as well.

What we're going to be doing also is

fuzzing again. So, let's take a peek

at some of the instructions that they

give us here. So, we have a a login. So,

we're going to be demonstrating on the

brute-force part of things, and we're

going to be doing an attack and fuzz on

the spot, the moment in time when we are

actually inputting the credentials. So, in

here, they do

find a test 1, 2, 3, and

we'll do something similar to that.

I have my own technique or word that I

like to look for, and that's fine. You'll

have your own that you like

as well.

So, we're going to find the GET and we're

going to do a fuzz.

Alright, then. I actually did all this in

another video, so you'll see it in

this dropdown on the screen here.

Now, what's unique is that actually Kali

comes with its own--it comes with tons

of word lists, but it comes with a one

called FastTrack. I've actually never

used FastTrack. I use my own word lists,

and that's fine too. But for this

particular challenge, we will be using

the fasttrack.txt.

Alright, let's open up our ZAP machine

and

navigate to the HTTP for this. So, I'm

going to

open up my browser here.

And because my browser is pointing to my

proxy server, I'm going to see

the websites actually populate inside of

my sites here, and you can see them

popping up there right now.

And according to the instructions on TryHackMe,

we will need to go to brute-force.

And at this point, we're going to

actually input

some data that we're going to catch. So,

we can see it populating here, which is

great.

I'm going to actually expand this,

and we're going to send something to it.

RedBlue.

Password.

And then I'm going to hit enter.

So, it says incorrect,

and that is fine.

What I like to do, actually, is knowing

because I know that I put RedBlue in

there, I actually like to search on that

and search for all, and then hit enter.

And I've got a post here. We found the

post where

my password and name was put in there.

Let's open up resend. And you can see my

username here and the password there. So,

what we're going to do is actually fuzz

on that password there.

So, we've got it selected, I'm going to

remove that because I just do that every

time. I'm going to double-click, and we're

going to add the word list that it

is recommending. So, in this case, it was

FastTrack.

We'll find word lists.

File. Select.

Bingo bango.

Okay.

Add.

Okay.

Options.

Follow redirects

and we are going to start the fuzzer.

And we will investigate each of these

reflected.

We had a couple options that were

good. Security

and password. Let's try both of those.

Password.

So, we can see that this one is in fact

the password that actually worked when

we brute-forced it. So, it's just straight

up password.

There you go. So, that was

brute-forcing with web login.

ZAP extensions.

So, ZAP's really cool and that it has

a ton of extensions that we can actually

add to

our tool. And in this page, this part

here, they're actually giving us

instructions on where to find some of

these tools. So, I recommend going ahead

and actually locating these things, and

and testing them out if you're enjoying

ZAP. Then, learn more about these

things, and maybe you can even build your

own scripts that we can add. But for TryHackMe,

we are

happy with knowing that we can do that.

Let's go on to task 10.

And it's more documentation, though,

I kind of find it funny about this

particular section is that it...

The author's, like, "Yeah that's pretty

much all there is." Which is kind

of true. Because Burp is so

popular, it's got so much documentation

on it,

it's just so widely adopted that ZAP

sort of has been put into the

background.

But I don't think that should be the

case. It is actually a pretty cool tool,

and it's been around a while, and it has...

I just, I just, I enjoy using sound.

There you go. So, we can finish this room

with a completed.

And bingo bango. There you go. We have

finished the introduction to ZAP

room. Thanks for watching.