ZAPpingTheTop10-2013 - Revision history

Rick.mitchell: Rick.mitchell moved page ZAPpingTheTop10 to ZAPpingTheTop10-2013: Prep for 2017 update

2017-12-18T14:25:15Z

Rick.mitchell moved page ZAPpingTheTop10 to ZAPpingTheTop10-2013: Prep for 2017 update

Rick.mitchell: Updated per https://github.com/zaproxy/zaproxy/issues/3883

2017-10-13T17:17:40Z

Updated per https://github.com/zaproxy/zaproxy/issues/3883

Psiinon: Updated links to point to github

2015-06-18T08:51:34Z

Updated links to point to github

Show changes

Psiinon at 11:19, 26 November 2014

2014-11-26T11:19:39Z

Rick.mitchell at 14:43, 28 August 2014

2014-08-28T14:43:06Z

Psiinon at 14:00, 28 August 2014

2014-08-28T14:00:42Z

Psiinon: Created page with "= ZAPping the OWASP Top 10 =
This document gives an overview of the automatic and manual components provided by the OWASP Zed Attack Proxy Project (ZAP) that are reco..."

2014-08-28T11:15:01Z

Created page with "= ZAPping the OWASP Top 10 = This document gives an overview of the automatic and manual components provided by the OWASP Zed Attack Proxy Project (ZAP) that are reco..."

New page

= ZAPping the OWASP Top 10 =

This document gives an overview of the automatic and manual components provided by the [[OWASP Zed Attack Proxy Project ]] (ZAP) that are recommended for testing each of the [[OWASP Top Ten Project]] 2013 risks.

Note that the [[OWASP Top Ten Project]] risks cover a wide range of underlying vulnerabilities, some of which are not really possible to test for in a completely automated way. If a completely automated tool claims to protect you against the full OWASP Top Ten then you can be sure they are being ‘economical with the truth’! A printable (pdf) version of this document can be downloaded [http://sourceforge.net/projects/zaproxy/files/docs/ZAPpingTheOwaspTop10.pdf/download here] 
The component links take you to the relevant places in an online version of the ZAP User Guide from which you can learn more.

<table class="wikitable">
<tr><td style="border: 1px solid #ccc; padding: 5px;"> </td><td style="border: 1px solid #ccc; padding: 5px;"> Common components </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> </td><td style="border: 1px solid #ccc; padding: 5px;"> The 'common components' can be used for pretty much everything, so can be used to help detect all of the Top 10 </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zaproxy/wiki/HelpStartConceptsIntercept Intercepting proxy] </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zaproxy/wiki/HelpUiDialogsMan_req Manual request] / [https://code.google.com/p/zaproxy/wiki/HelpUiDialogsResend resend] </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zaproxy/wiki/HelpAddonsScriptsScripts Scripts] </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zaproxy/wiki/HelpUiTabsSearch Search] </td></tr>

<tr><td style="border: 1px solid #ccc; padding: 5px;"> A1 </td><td style="border: 1px solid #ccc; padding: 5px;"> [[Top_10_2013-A1-Injection | A1 Injection]] </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Automated </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zaproxy/wiki/HelpStartConceptsAscan Active Scan Rules] ([https://code.google.com/p/zaproxy/wiki/HelpAddonsAscanrulesAscanrules Release], [https://code.google.com/p/zap-extensions/wiki/HelpAddonsAscanrulesBetaAscanbeta Beta]<tt>*</tt> and [https://code.google.com/p/zap-extensions/wiki/HelpAddonsAscanrulesAlphaAscanalpha Alpha]<tt>*</tt>) </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Automated </td><td style="border: 1px solid #ccc; padding: 5px;"> SQLMap Injection Engine (Beta<tt>*</tt>) </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zaproxy/wiki/HelpStartConceptsFuzz Fuzzer], combined with the [https://code.google.com/p/zap-extensions/wiki/AddOn_fuzzdb FuzzDb (Release)]<tt>*</tt> and SVN Digger (Beta)<tt>*</tt> files </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> Diviner (Alpha)<tt>*</tt> </td></tr>

<tr><td style="border: 1px solid #ccc; padding: 5px;"> A2 </td><td style="border: 1px solid #ccc; padding: 5px;"> [[Top_10_2013-A2-Broken_Authentication_and_Session_Management | A2 Broken Authentication and Session Management]] </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zaproxy/wiki/HelpStartConceptsHttpsessions Http Sessions] </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zaproxy/wiki/HelpStartConceptsSpider Spider] </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zaproxy/wiki/HelpAddonsBruteForceConcepts Forced Browse (Beta)] </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zap-extensions/wiki/AddOn_tokengen Token Generator (Beta)]<tt>*</tt> </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> Diviner (Alpha)<tt>*</tt> </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> Vehicle (Alpha)<tt>*</tt> </td></tr>

<tr><td style="border: 1px solid #ccc; padding: 5px;"> A3 </td><td style="border: 1px solid #ccc; padding: 5px;"> [[Top_10_2013-A3-Cross-Site_Scripting_(XSS) | A3 Cross-Site Scripting (XSS)]] </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Automated </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zaproxy/wiki/HelpStartConceptsAscan Active Scan Rules] ([https://code.google.com/p/zaproxy/wiki/HelpAddonsAscanrulesAscanrules Release]) </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zaproxy/wiki/HelpStartConceptsFuzz Fuzzer], combined with the [https://code.google.com/p/zap-extensions/wiki/AddOn_fuzzdb FuzzDb (Release)]<tt>*</tt> and SVN Digger (Beta)<tt>*</tt> files </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zaproxy/wiki/HelpAddonsPlugnhackPlugnhack Plug-n-Hack (Beta)] </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> Diviner (Alpha)<tt>*</tt> </td></tr>

<tr><td style="border: 1px solid #ccc; padding: 5px;"> A4 </td><td style="border: 1px solid #ccc; padding: 5px;"> [[Top_10_2013-A4-Insecure_Direct_Object_References | A4 Insecure Direct Object References]] </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zaproxy/wiki/HelpUiTabsParams Params tab] </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> Diviner (Alpha)<tt>*</tt> </td></tr>

<tr><td style="border: 1px solid #ccc; padding: 5px;"> A5 </td><td style="border: 1px solid #ccc; padding: 5px;"> [[Top_10_2013-A5-Security_Misconfiguration | A5 Security Misconfiguration]] </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Automated </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zaproxy/wiki/HelpStartConceptsAscan Active Scan Rules] ([https://code.google.com/p/zaproxy/wiki/HelpAddonsAscanrulesAscanrules Release], [https://code.google.com/p/zap-extensions/wiki/HelpAddonsAscanrulesBetaAscanbeta Beta]<tt>*</tt> and [https://code.google.com/p/zap-extensions/wiki/HelpAddonsAscanrulesAlphaAscanalpha Alpha]<tt>*</tt>) </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Automated </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zaproxy/wiki/HelpStartConceptsPscan Passive Scan Rules] ([https://code.google.com/p/zaproxy/wiki/HelpAddonsPscanrulesPscanrules Release], [https://code.google.com/p/zap-extensions/wiki/HelpAddonsPscanrulesBetaPscanbeta Beta]<tt>*</tt> and [https://code.google.com/p/zap-extensions/wiki/HelpAddonsPscanrulesAlphaPscanalpha Alpha]<tt>*</tt>) </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> <tt>HttpsInfo</tt> (Alpha)<tt>*</tt> </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zap-extensions/wiki/HelpAddonsPortscanConcepts Port Scanner (Beta)]<tt>*</tt> </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zap-extensions/wiki/HelpAddonsWappalyzerWappalyzer Technology detection (Alpha)]<tt>*</tt> </td></tr>

<tr><td style="border: 1px solid #ccc; padding: 5px;"> A6 </td><td style="border: 1px solid #ccc; padding: 5px;"> [[Top_10_2013-A6-Sensitive_Data_Exposure | A6 Sensitive Data Exposure]] </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Automated </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zaproxy/wiki/HelpStartConceptsAscan Active Scan Rules] ([https://code.google.com/p/zaproxy/wiki/HelpAddonsAscanrulesAscanrules Release], [https://code.google.com/p/zap-extensions/wiki/HelpAddonsAscanrulesBetaAscanbeta Beta]<tt>*</tt> and [https://code.google.com/p/zap-extensions/wiki/HelpAddonsAscanrulesAlphaAscanalpha Alpha]<tt>*</tt>) </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Automated </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zaproxy/wiki/HelpStartConceptsPscan Passive Scan Rules] ([https://code.google.com/p/zaproxy/wiki/HelpAddonsPscanrulesPscanrules Release], [https://code.google.com/p/zap-extensions/wiki/HelpAddonsPscanrulesBetaPscanbeta Beta]<tt>*</tt> and [https://code.google.com/p/zap-extensions/wiki/HelpAddonsPscanrulesAlphaPscanalpha Alpha]<tt>*</tt>) </td></tr>

<tr><td style="border: 1px solid #ccc; padding: 5px;"> A7 </td><td style="border: 1px solid #ccc; padding: 5px;"> [[Top_10_2013-A7-Missing_Function_Level_Access_Control | A7 Missing Function Level Access Control]] </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zaproxy/wiki/HelpStartConceptsSpider Spider] </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zaproxy/wiki/HelpAddonsSpiderAjaxConcepts Ajax Spider (Beta)] </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zaproxy/wiki/HelpUiTlmenuReport#Compare_with_another_Session... Session comparison] </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> Access Control (Currently only available in Weekly release) </td></tr>

<tr><td style="border: 1px solid #ccc; padding: 5px;"> A8 </td><td style="border: 1px solid #ccc; padding: 5px;"> [[Top_10_2013-A8-Cross-Site_Request_Forgery_(CSRF) | A8 Cross-Site Request Forgery (CSRF)]] </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Automated </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zaproxy/wiki/HelpStartConceptsAscan Active Scan Rules] ([https://code.google.com/p/zap-extensions/wiki/HelpAddonsAscanrulesBetaAscanbeta Beta])<tt>*</tt> </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Automated </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zaproxy/wiki/HelpStartConceptsPscan Passive Scan Rules] ([https://code.google.com/p/zap-extensions/wiki/HelpAddonsPscanrulesBetaPscanbeta Beta])<tt>*</tt> </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zaproxy/wiki/HelpUiTabsSites#Generate_anti_CSRF_test_form Generate Anti CSRF Test Form] </td></tr>

<tr><td style="border: 1px solid #ccc; padding: 5px;"> A9 </td><td style="border: 1px solid #ccc; padding: 5px;"> [[Top_10_2013-A9-Using_Components_with_Known_Vulnerabilities | A9 Using Components with Known Vulnerabilities]] </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Automated </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zaproxy/wiki/HelpStartConceptsPscan Passive Scan Rules] ([https://code.google.com/p/zap-extensions/wiki/HelpAddonsPscanrulesAlphaPscanalpha Alpha])<tt>*</tt> </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zap-extensions/wiki/HelpAddonsWappalyzerWappalyzer Technology detection (Alpha)]<tt>*</tt> </td></tr>

<tr><td style="border: 1px solid #ccc; padding: 5px;"> A10 </td><td style="border: 1px solid #ccc; padding: 5px;"> [[Top_10_2013-A10-Unvalidated_Redirects_and_Forwards | A10 Unvalidated Redirects and Forwards]] </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Automated </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zaproxy/wiki/HelpStartConceptsAscan Active Scan Rules] ([https://code.google.com/p/zaproxy/wiki/HelpAddonsAscanrulesAscanrules Release]) </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zaproxy/wiki/HelpStartConceptsFuzz Fuzzer], combined with the [https://code.google.com/p/zap-extensions/wiki/AddOn_fuzzdb FuzzDb (Release)]<tt>*</tt> and SVN Digger (Beta)<tt>*</tt> files </td></tr>
<tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> Diviner (Alpha)<tt>*</tt> </td></tr>
</table>

<tt>*</tt> The stared add-ons are not included by default in the full ZAP release but can be downloaded from the ZAP Marketplace via the [https://code.google.com/p/zap-extensions/wiki/Introduction ‘Manage add-ons’] button on the ZAP main toolbar.

@@ Line 18: / Line 18: @@
   <tr><td style="border: 1px solid #ccc; padding: 5px;"> Automated </td><td style="border: 1px solid #ccc; padding: 5px;"> SQLMap Injection Engine (Beta<tt>*</tt>)  </td></tr>
   <tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://github.com/zaproxy/zap-core-help/wiki/HelpStartConceptsFuzz Fuzzer], combined with the [https://github.com/zaproxy/zap-extensions/wiki/AddOn_fuzzdb FuzzDb (Release)]<tt>*</tt> and SVN Digger (Beta)<tt>*</tt> files </td></tr>
   <tr><td style="border: 1px solid #ccc; padding: 5px;"> <font size="5"> A2 </font> </td><td style="border: 1px solid #ccc; padding: 5px;"> <font size="5"> [[Top_10_2013-A2-Broken_Authentication_and_Session_Management | A2 Broken Authentication and Session Management]]</font> </td></tr>
@@ Line 25: / Line 24: @@
   <tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://github.com/zaproxy/zap-core-help/wiki/HelpAddonsBruteForceConcepts Forced Browse (Beta)] </td></tr>
   <tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://github.com/zaproxy/zap-extensions/wiki/AddOn_tokengen Token Generator (Beta)]<tt>*</tt> </td></tr>
   <tr><td style="border: 1px solid #ccc; padding: 5px;"> <font size="5"> A3 </font> </td><td style="border: 1px solid #ccc; padding: 5px;"> <font size="5">[[Top_10_2013-A3-Cross-Site_Scripting_(XSS) | A3 Cross-Site Scripting (XSS)]] </font> </td></tr>
@@ Line 32: / Line 29: @@
   <tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://github.com/zaproxy/zap-core-help/wiki/HelpStartConceptsFuzz Fuzzer], combined with the [https://github.com/zaproxy/zap-extensions/wiki/AddOn_fuzzdb FuzzDb (Release)]<tt>*</tt> and SVN Digger (Beta)<tt>*</tt> files </td></tr>
   <tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://github.com/zaproxy/zap-core-help/wiki/HelpAddonsPlugnhackPlugnhack Plug-n-Hack (Beta)] </td></tr>
   <tr><td style="border: 1px solid #ccc; padding: 5px;"> <font size="5"> A4 </font> </td><td style="border: 1px solid #ccc; padding: 5px;"> <font size="5"> [[Top_10_2013-A4-Insecure_Direct_Object_References | A4 Insecure Direct Object References]] </font> </td></tr>
   <tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://github.com/zaproxy/zap-core-help/wiki/HelpUiTabsParams Params tab] </td></tr>
   <tr><td style="border: 1px solid #ccc; padding: 5px;"> <font size="5"> A5 </font> </td><td style="border: 1px solid #ccc; padding: 5px;"> <font size="5"> [[Top_10_2013-A5-Security_Misconfiguration | A5 Security Misconfiguration]] </font> </td></tr>
   <tr><td style="border: 1px solid #ccc; padding: 5px;"> Automated </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://github.com/zaproxy/zap-core-help/wiki/HelpStartConceptsAscan Active Scan Rules] ([https://github.com/zaproxy/zap-core-help/wiki/HelpAddonsAscanrulesAscanrules Release], [https://github.com/zaproxy/zap-extensions/wiki/HelpAddonsAscanrulesBetaAscanbeta Beta]<tt>*</tt> and [https://github.com/zaproxy/zap-extensions/wiki/HelpAddonsAscanrulesAlphaAscanalpha Alpha]<tt>*</tt>) </td></tr>
   <tr><td style="border: 1px solid #ccc; padding: 5px;"> Automated </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://github.com/zaproxy/zap-core-help/wiki/HelpStartConceptsPscan Passive Scan Rules] ([https://github.com/zaproxy/zap-core-help/wiki/HelpAddonsPscanrulesPscanrules Release], [https://github.com/zaproxy/zap-extensions/wiki/HelpAddonsPscanrulesBetaPscanbeta Beta]<tt>*</tt> and [https://github.com/zaproxy/zap-extensions/wiki/HelpAddonsPscanrulesAlphaPscanalpha Alpha]<tt>*</tt>) </td></tr>
-  <tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> <tt>HttpsInfo</tt>  (Alpha)<tt>*</tt> </td></tr>
+  <tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://github.com/zaproxy/zap-extensions/wiki/HelpAddonsHttpsinfoHttpsinfo HttpsInfo (Alpha)]<tt>*</tt> </td></tr>
   <tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://github.com/zaproxy/zap-extensions/wiki/HelpAddonsPortscanConcepts Port Scanner (Beta)]<tt>*</tt> </td></tr>
   <tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://github.com/zaproxy/zap-extensions/wiki/HelpAddonsWappalyzerWappalyzer Technology detection (Alpha)]<tt>*</tt> </td></tr>
@@ Line 53: / Line 48: @@
   <tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://github.com/zaproxy/zap-core-help/wiki/HelpAddonsSpiderAjaxConcepts Ajax Spider (Beta)] </td></tr>
   <tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://github.com/zaproxy/zap-core-help/wiki/HelpUiTlmenuReport#Compare_with_another_Session... Session comparison] </td></tr>
-  <tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> Access Control (Currently only available in Weekly release) </td></tr>
+  <tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://github.com/zaproxy/zap-extensions/wiki/HelpAddonsAccessControlConcepts Access Control (Alpha)] </td></tr>
   <tr><td style="border: 1px solid #ccc; padding: 5px;"> <font size="5"> A8 </font> </td><td style="border: 1px solid #ccc; padding: 5px;"> <font size="5"> [[Top_10_2013-A8-Cross-Site_Request_Forgery_(CSRF) | A8 Cross-Site Request Forgery (CSRF)]] </font> </td></tr>
@@ Line 67: / Line 62: @@
   <tr><td style="border: 1px solid #ccc; padding: 5px;"> Automated </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://github.com/zaproxy/zap-core-help/wiki/HelpStartConceptsAscan Active Scan Rules] ([https://github.com/zaproxy/zap-core-help/wiki/HelpAddonsAscanrulesAscanrules Release]) </td></tr>
   <tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://github.com/zaproxy/zap-core-help/wiki/HelpStartConceptsFuzz Fuzzer], combined with the [https://github.com/zaproxy/zap-extensions/wiki/AddOn_fuzzdb FuzzDb (Release)]<tt>*</tt> and SVN Digger (Beta)<tt>*</tt> files </td></tr>
   </table>
 <tt>*</tt> The stared add-ons are not included by default in the full ZAP release but can be downloaded from the ZAP Marketplace via the [https://github.com/zaproxy/zap-extensions/wiki/Introduction ‘Manage add-ons’] button on the ZAP main toolbar. </p>

@@ Line 61: / Line 61: @@
   <tr><td style="border: 1px solid #ccc; padding: 5px;"> <font size="5"> A9 </font> </td><td style="border: 1px solid #ccc; padding: 5px;"> <font size="5"> [[Top_10_2013-A9-Using_Components_with_Known_Vulnerabilities | A9 Using Components with Known Vulnerabilities]] </font> </td></tr>
-  <tr><td style="border: 1px solid #ccc; padding: 5px;"> Automated </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zaproxy/wiki/HelpStartConceptsPscan Passive Scan Rules] ([https://code.google.com/p/zap-extensions/wiki/HelpAddonsPscanrulesAlphaPscanalpha Alpha])<tt>*</tt> </td></tr>
+  <tr><td style="border: 1px solid #ccc; padding: 5px;"> Automated </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zaproxy/wiki/HelpStartConceptsPscan Passive Scan Rules] ([https://code.google.com/p/zap-extensions/wiki/HelpAddonsPscanrulesAlphaPscanalpha Alpha])<tt>*</tt> and Retire (Alpha)<tt>*</tt> </td></tr>
   <tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zap-extensions/wiki/HelpAddonsWappalyzerWappalyzer Technology detection (Alpha)]<tt>*</tt> </td></tr>

@@ Line 7: / Line 7: @@
 <table class="wikitable">
-<tr><td style="border: 1px solid #ccc; padding: 5px;"> <font size="5"> </font> </td><td style="border: 1px solid #ccc; padding: 5px;"> <font size="5"> Common components </font> </td></tr>
+<tr><td style="border: 1px solid #ccc; padding: 5px;"> <font size="5"> </font> </td><td style="border: 1px solid #ccc; padding: 5px;"> <font size="5"> Common Components </font> </td></tr>
 <tr><td style="border: 1px solid #ccc; padding: 5px;"> </td><td style="border: 1px solid #ccc; padding: 5px;"> The &#x27;common components&#x27; can be used for pretty much everything, so can be used to help detect all of the Top 10  </td></tr>
 <tr><td style="border: 1px solid #ccc; padding: 5px;"> Manual </td><td style="border: 1px solid #ccc; padding: 5px;"> [https://code.google.com/p/zaproxy/wiki/HelpStartConceptsIntercept Intercepting proxy] </td></tr>

@@ Line 3: / Line 3: @@
 <p>This document gives an overview of the automatic and manual components provided by the [[OWASP Zed Attack Proxy Project ]] (ZAP) that are recommended for testing each of the [[OWASP Top Ten Project]] 2013 risks.
-</p><p>Note that the [[OWASP Top Ten Project]] risks cover a wide range of underlying vulnerabilities, some of which are not really possible to test for in a completely automated way. If a completely automated tool claims to protect you against the full OWASP Top Ten then you can be sure they are being ‘economical with the truth’! </p><p>A printable (pdf) version of this document can be downloaded [http://sourceforge.net/projects/zaproxy/files/docs/ZAPpingTheOwaspTop10.pdf/download here] </p><p>
+</p><p>Note that the [[OWASP Top Ten Project]] risks cover a wide range of underlying vulnerabilities, some of which are not really possible to test for in a completely automated way. If a completely automated tool claims to protect you against the full OWASP Top Ten then you can be sure they are being ‘economical with the truth’! </p><p>A printable (pdf) version of this document is also available: [https://www.owasp.org/index.php/File:ZAPpingTheOwaspTop10.pdf ZAPpingTheOwaspTop10.pdf] </p><p>
 The component links take you to the relevant places in an online version of the ZAP User Guide from which you can learn more.

← Older revision	Revision as of 14:25, 18 December 2017
(No difference)