Keeping it the same vein as Nikto, we're going to be using another tool.
This one, we're going to walk through the installation very quickly.
A lot of the steps we're very familiar with, but we're going to be kind of
combining
Nikto with the power of OWASP and the top 10 to do a compare and contrast to
hopefully give us a little bit more detail than what Nikto can when we're doing
our
initial assessment of websites and web applications.
We're going to start off by going in and doing a pseudo app install ZA proxy.
And this is a ZAP proxy.
It's not installed by default with Kali, which is why we're doing the manual
installation of it.
And you may see me skip through a couple of pauses in here, like this one,
because the internet is being a little bit slow today.
And I don't want to waste your time.
Just like that, it's installed.
We're going to go up to our top left and go into the actual menu itself and
type
in the ZAP.
And you can see that the first option to come up is ZA proxy or ZAP proxy.
However, you want to pronounce that.
We're going to go ahead and open it up.
And this allows us to also have a GUI form as well too to do more examination.
Now this is utilizing a lot of the resources that are already installed in
Kali as a baseline.
And I'm going to let this load up and then also explain that we're going to be
using this as a proxy itself.
Now the proxy is going to be 127.001 inside of our actual browser itself.
So when we do this, do we want to to persist the ZAP, the ZAP session?
Yeah, we'll go ahead and do this on the actual timestamp itself and make it to
where we keep this going with the actual time of the actual system.
So that way we can go ahead and be familiar with everything according to our
timestamp.
Now, if you're on the forensic side of the house, you'll definitely need to
take
note of this because this is something that we need to keep in line with what's
going on on their network versus ours.
We may be in different time zones, for instance.
Now, as I mentioned, we do need to make sure that our proxy is set up.
And I apologize for the lag of the mouse inside of our lab.
Based on your web browser, you can go inside of settings and set up the actual
proxy itself, which we're going to be doing inside of Firefox.
Now I'm not too familiar with Firefox because it's not my go to browser, but
most browsers you could just go in and just type in inside the search bars and
type in proxy and go to your settings.
We are going to do a manual proxy configuration of 127.0.0.1.
And this by default, uses port 80 80 as our actual proxy.
And you'll make note that this is happening over HTTP and not HTTPS, but we
can also check and we will the box right below it for using this as our SSL/TLS
proxy to keep everything simplistic.
And just like that, we are set up inside of our browser.
Now I'm going to go ahead and minimize this and go back to our zap.
And these are all the services that are available to us that we may need to
update or install.
So you can see that none of them are selected and we can go through here and
select which ones that we actually want to look at for actually taking a look
at
the website that we're going to be doing in question.
Now keep in mind that these are going to fall under the same category of
stealthiness as Nikto and other browsers and vulnerability assessment scanners
out
there. So if you're looking at doing this as far as being stealthy, you might
want
to take a look at what the traffic is being generated behind the scenes.
Now I have selected for us some basic ones that we're going to be walking
through inside of our initial scan of bwap.test.
First one is this active scanner rules.
And when you select it, you can actually go through and see the description
and what this is supposed to be doing.
This one is the release active scanner rules tied into the basic rule set of z
ap.
And we have also have selected directory list to give us a list of
potential directories based on the capability of permissions to give us.
And it's also used with forced browser browse and fuzzer add-on.
So basically what it's doing is it's going in and trying to get all the
directory information from that particular target.
Along with that, we do the forced browse.
And again, that's with the directory list.
And the other one that I selected was web sockets.
And this allows us to be able to inspect any kind of socket communication to
and from that particular website to see if there are any other ports or
protocols be it used with that particular domain.
Now, as I want to point out here, you might want to maximize this because
by if you're doing this inside of a VM environment, especially inside of this
lab
right here, you'll need to do this to be able to see not only the full
description and where the info comes from, but also the buttons on the bottom
to be able to update this.
So I've gone through and updated everything and already still have
selected everything that I want to scan with.
And I'm going to go ahead and close this and you'll see that we're at our
default
screen. Now, if I open this up, this looks very familiar to a tool that we're
going to be using later on called burp suite.
This is the same idea.
And when we get into burp suite doing this, we'll make that a little bit easier
for
us. So now that we have our base configuration for the ZAP proxy configured,
we can go ahead and go back to our web browser here.
I'm going to refresh the page of bwap.test and the traffic from here,
because we have the proxy set up inside of our configuration,
going back to our ZAP GUI here, I can expand sites
and we can see now that, and I'm going to zoom in for you here real quick,
that we have bwap.test as one of the sites that's been picked up by our proxy.
In here, you can see that we have a directory listing.
And although this isn't everything that the site has to offer,
the tools like Nikto Nikto showed us Nikto.
But the more that we browse on this site, the more information and more files
that
we begin to pick up from the actual website.
So let's browse around a little bit, go to the info tab,
talks the training, the blog page, and we're even going to a different site now
.
I'm going to close that tab real quick.
Go back to the login screen and now I'm going to log in with my credentials of
B
and bug and going tab it over.
Now you can see that we have all sorts of different pieces of information
inside
of our proxy gatherer.
Now this is really good for us to be able to examine because if I go to our bw
ap
test site, oh, sorry, and now look at the expansion on this,
we can see that we actually have more information and more calls to the actual
site itself, such as portal.php, training.php, and the initial login screen
itself.
Now, what can we do from here?
Well, I'm glad you asked.
We can actually right click on this and go to attack and we have different
methods
of being able to attack this actual page or site.
Now, this is where we have to have explicit permission and stay inside of our
sandbox to be able to do this.
So I'm going to try to keep this as quick as possible because we're not
attacking just yet.
I wanted you to be familiar with the tool, but we do want to go in and do it
active scan on the actual page itself.
And we have different policies that are available to us by default.
I'm going to leave it a default policy in scan.
And you can see here that we have a lot of results come up in the bottom of our
page.
And I'm going to let this run and then I will come right back when it's
complete.
So our initial scan is done.
What does that leave us with?
Well, pretty simple.
We just go up to the top to our report tab.
Let me pop out and zoom in for you right here.
We're just going to generate a report because right now we're not actually
doing
any kind of exploit.
We just want to see what vulnerabilities potentially exist on this website.
So let's go ahead and generate a report.
And you'll notice here that based on our traffic that we performed inside of
that
web browser, we can see that many different sites show up or FQD ends.
We're just going to select the be WAP.test because that's the one that we have
permission for inside of the slab.
And we're going to also check the display report so that way we can, you know,
see where this have it open up after it generates based on where you save it.
You might want to go into the directory and change that.
I'm actually going to put this inside of the desktop and inside of the Nito
folder.
Come on, double click.
There we go.
And I want to save it inside of there and then generate report.
So it take just a second and here we are.
Here's our report.
Now, what does this do for us?
Well, right off the bat, as I pop out and zoom in for you, you could see here
that we already have some alerts to us.
We have some medium lows and information.
So essentially what we did was is we ran a different version of Nethith
inside of this actual site to see what potential vulnerabilities exist for us
later on.
And we're just going to click on the risk of medium with the confidence of high
and C that our content security policy header was not set.
Now we can explore these a little bit further by clicking on the actual
site link and going into the explanation.
And just like a CVE, we have more information pertaining to that actual site.