HelpPentestPentest
A basic penetration test is made up of the following steps:
Use your browser to explore all of the functionality provided by the application. Follow all links, press all buttons and fill in and submit all forms. If the applications supports multiple roles then do this for each of the roles. For each role save the ZAP session in a different file and start a new session before you start using the next role.
Use the spider to find URLs that you have either missed or that are hidden. You can also use the AJAX Spider add-on to improve the results and crawl the dynamic-built links. Explore any links found.
Use the forced browse scanner to find unreferenced files and directories (requires "Forced Browse" add-on).
Use the active scanner to find basic vulnerabilities.
The above steps will find basic vulnerabilities. However to find more vulnerabilities you will need to manually test the application. See the OWASP Testing Guide for more details. Future versions of the ZAP Desktop User Guide will describe how ZAP can be used to help this process.
| Getting Started | for details of how to start using ZAP | |
| Introduction | the introduction to ZAP |
| https://www.owasp.org/index.php/Category:OWASP_Testing_Project | OWASP Testing Guide |
-
ZAP User Guide
- Introduction
-
Getting Started
- Configuring proxies
-
Features
- Active Scan
- Add-ons
- Alerts
- Anti CSRF Tokens
- API
- Authentication
- Break Points
- Callbacks
- Contexts
- Data Driven Content
- Filters
- Globally Excluded URLs
- HTTP Sessions
- Man-in-the-middle Proxy
- Modes
- Notes
- Passive Scan
- Scan Policies
- Scope
- Session Management
- Spider
- Statistics
- Structural Modifiers
- Structural Parameters
- Tags
- Users
- Scanner Rules
- A Simple Penetration Test
-
The User Interface
- Overview
- The Top Level Menu
- The Top Level Toolbar
- The Tabs
-
The Dialogs
- Active Scan
- Add Alert
- Add Break Point
- Add Note
- Encode/Decode/Hash
- Filter
- Find
- History Filter
- Manual Request Editor
- Manage Add-ons
- Manage Tags
-
Options
- Active Scan
- Active Scan Input Vectors
- Alerts
- Anti CSRF Tokens
- API
- Breakpoints
- Callback Address
- Certificate
- Check for Updates
- Connection
- Database
- Display
- Dynamic SSL Certificates
- Extensions
- Global Exclude URL
- HTTP Sessions
- JVM
- Keyboard
- Language
- Local Proxies
- Passive Scan Rules
- Passive Scan Tags
- Passive Scanner
- Rule Configuration
- Scripts
- Search
- Spider
- Statistics
- Persist Session
- Resend
- Scan Policy Manager
- Scan Progress
- Session
- Spider
- The Footer
- Command Line
- Add Ons
- Releases
- Paros Proxy
- Credits
