|
|
(100 intermediate revisions by 10 users not shown) |
Line 1: |
Line 1: |
− | = Main =
| + | <div style="width:100%;height:90px;border:0,margin:0;overflow: hidden;">[[File: flagship_big.jpg|link=]]</div> |
− | <div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div> | |
− | | |
| {| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |- | | {| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |- |
− | | valign="top" style="border-right: 1px dotted gray;padding-right:25px;" | | + | | style="border-right: 1px dotted gray;padding-right:25px;" valign="top" | |
− | | |
− | [[Image:Toolswatch2013.png|link=http://www.toolswatch.org/2013/12/2013-top-security-tools-as-voted-by-toolswatch-org-readers/ | right]]
| |
| {{ReviewProject|projectname=zaproxy|language=en}} | | {{ReviewProject|projectname=zaproxy|language=en}} |
| <div style="font-size:120%;border:none;margin: 0;color:#000"> | | <div style="font-size:120%;border:none;margin: 0;color:#000"> |
− | The Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications.
| + | For more details about ZAP see the new ZAP website at [https://www.zaproxy.org zaproxy.org][[Image:Zap-website.png | link=https://www.zaproxy.org/]] |
| | | |
− | It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing.
| + | {{Social Media Links}} |
| | | |
− | ZAP provides automated scanners as well as a set of tools that allow you to find security vulnerabilities manually.
| + | | style="padding-left:25px;width:200px;" valign="top" | |
| | | |
− | '''ZAP 2.3.1 is now available! Download it here:'''
| + | == Quick Download == |
| | | |
− | [[Image:ZAP-Download.png | link=http://code.google.com/p/zaproxy/wiki/Downloads?tm=2]] | + | [https://github.com/zaproxy/zaproxy/wiki/Downloads Download OWASP ZAP!] |
| | | |
− | ZAP is taking part in the '''Google Summer of Code 2014'''. See the [https://www.owasp.org/index.php/GSoC2014_Ideas#OWASP_ZAP_-_Advanced_access_control_testing OWASP wiki] for suggested projects. And if you have any questions about this please ask them on the [http://groups.google.com/group/zaproxy-develop ZAP dev group] | + | == Donate to ZAP == |
| | | |
− | ''' ZAP Is the [http://www.toolswatch.org/2013/12/2013-top-security-tools-as-voted-by-toolswatch-org-readers/ Top Security Tool of 2013 as voted by ToolsWatch.org readers]! '''
| + | <div class="center" style="width: auto; margin-left: auto; margin-right: auto;">{{#widget:PayPal Donation |
| + | |target=_blank |
| + | |budget=Zed Attack Proxy }} |
| + | </div> |
| | | |
− | For a quick overview of ZAP and to see some of the more advanced ZAP features see these tutorial videos on YouTube:
| + | == News and Events == |
| + | Please see the [https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project#News News] and [https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project#Talks Talks] tabs |
| | | |
− | {|
| + | == Change Log == |
− | |-
| + | * [https://github.com/zaproxy/zaproxy/commits/develop zaproxy] |
− | {{#ev:youtube|eH0RBI0nmww}}
| + | * [https://github.com/zaproxy/zap-extensions/commits/master zap-extensions] |
− | {{#ev:youtube|Ofmp-haNI7s}}
| |
− | |}
| |
− | | |
− | For more videos see the links on the [https://code.google.com/p/zaproxy/wiki/Videos wiki videos page].
| |
− | | |
− | Interested in a ZAP talk or training event? See the [https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project#tab=Talks talks] tab. Not one near you? Contact a [http://code.google.com/p/zaproxy/wiki/ZapEvangelists Zap Evangelist] to arrange one!
| |
− | | |
− | Want a very quick introduction? See the [https://www.owasp.org/index.php/File:owasp_zap_flyer_v2.pdf project pamphlet].
| |
− | | |
− | For a slightly longer introduction see the [http://www.owasp.org/images/c/c8/Conference_Style_slides_for_ZAP.ppt project presentation].
| |
− | | |
− | For more details about ZAP, including the full user guide, see the [https://code.google.com/p/zaproxy/wiki/Introduction wiki].
| |
− | | |
− | We recently asked our users for feedback about ZAP, you can see their responses (which are separate for each languages) here: [https://docs.google.com/forms/d/1lUPTYHe9CS5tropNStoRK9jVeZ7tWRywhBHDIZjE4cA/viewanalytics English], [https://docs.google.com/forms/d/1JhUdp4cxZ3qRayYWz3JHOLSP7DPdBI-zgnFzDWxbX5A/viewanalytics French], [https://docs.google.com/forms/d/1xAKE3TCOaBrmFnyAVUr6NdTd3mKvu7g_uGriOcS2Ka4/viewanalytics Spanish], [https://docs.google.com/forms/d/1qN3MlRcjQk9riIkdpfnJLkFd4cW5ALp136da08xvMaA/viewanalytics Arabic]
| |
− | | |
− | <paypal>Zed Attack Proxy</paypal>
| |
− | | |
− | {{Social Media Links}}
| |
− | | |
− | | valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |
| |
− | | |
− | == What is this? ==
| |
− | | |
− | The Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications.
| |
| | | |
| == Code Repo == | | == Code Repo == |
− | | + | * [https://github.com/zaproxy/zaproxy/ zaproxy] |
− | [http://zaproxy.googlecode.com/svn/trunk/ OWASP Zap! Proxy at Google Code] | + | * [https://github.com/zaproxy/zap-extensions/ zap-extensions] |
| | | |
| == Email List == | | == Email List == |
| | | |
− | Questions? Please sign up for our [https://lists.owasp.org/mailman/listinfo/owasp-zed-attack-proxy Project Support List ] | + | Questions? Please ask on the [http://groups.google.com/group/zaproxy-users ZAP User Group] |
| | | |
| == Project Leader == | | == Project Leader == |
| | | |
− | Project Leader<br/>[https://www.owasp.org/index.php/User:Psiinon Simon Bennetts] [mailto: [email protected] @] | + | Project Leader<br />[https://www.owasp.org/index.php/User:Psiinon Simon Bennetts] [mailto: [email protected] @] |
| + | |
| + | Co-Project Leaders<br />[https://www.owasp.org/index.php/User:Ricardo.Pereira Ricardo Pereira] [mailto:[email protected] @] |
| + | |
| + | [https://www.owasp.org/index.php/User:Rick.mitchell Rick Mitchell] [mailto:[email protected] @] |
| | | |
| == Related Projects == | | == Related Projects == |
| | | |
− | TBD
| + | * [https://www.owasp.org/index.php/OWASP_Web_Testing_Environment_Project OWASP WTE] |
| + | * [https://www.owasp.org/index.php/OWASP_OWTF OWASP OWTF] |
| | | |
− | == Ohloh == | + | == Open Hub Stats == |
| | | |
| *https://www.openhub.net/p/zaproxy | | *https://www.openhub.net/p/zaproxy |
− |
| |
− | | valign="top" style="padding-left:25px;width:200px;" |
| |
− |
| |
− | == Quick Download ==
| |
− |
| |
− | [http://code.google.com/p/zaproxy/wiki/Downloads?tm=2 Download OWASP ZAP!!]
| |
− |
| |
− | == News and Events ==
| |
− | TBD
| |
− |
| |
− | == Change Log ==
| |
− | TBD
| |
| | | |
| ==Classifications== | | ==Classifications== |
Line 88: |
Line 57: |
| {| width="200" cellpadding="2" | | {| width="200" cellpadding="2" |
| |- | | |- |
− | | align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]] | + | | rowspan="2" width="50%" valign="top" align="center" | [[File:Mature projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Flagship_Projects]] |
| + | | width="50%" valign="center" align="center" | [[File:Owasp-builders-small.png|link=]] |
| | | | | |
| |- | | |- |
− | | align="center" valign="top" width="50%"| [[File:Owasp-breakers-small.png|link=]] | + | | width="50%" valign="center" align="center" | [[File:Owasp-breakers-small.png|link=]] |
| |- | | |- |
− | | colspan="2" align="center" | [http://www.apache.org/licenses/LICENSE-2.0 Apache 2 License] | + | | colspan="2" align="center" | [http://www.apache.org/licenses/LICENSE-2.0 Apache 2 License] |
| |- | | |- |
− | | colspan="2" align="center" | [[File:Project_Type_Files_TOOL.jpg|link=]] | + | | colspan="2" align="center" | [[File:Project_Type_Files_TOOL.jpg|link=]] |
| |} | | |} |
| | | |
− | |} | + | |}<div style="font-size:120%;border:none;margin: 0;color:#000"> |
− | | |
− | = Screenshots =
| |
− | [[Image:zap128x128.png|right]]
| |
− | {|
| |
− | |-
| |
− | |
| |
− | [[Image:ZAP-ScreenShotAddAlert.png||400px||ZAP Add Alert Screen Shot]]
| |
− | |
| |
− | [[Image:ZAP-ScreenShotHelp.png||400px|left|ZAP Help Screen Shot]]
| |
− | |-
| |
− | |
| |
− | [[Image:ZAP-ScreenShotHistoryFilter.png|thumb|400px|left|ZAP History Filter Screen Shot]]
| |
− | |
| |
− | [[Image:ZAP-ScreenShotSearchTab.png|thumb|400px|left|ZAP Search Tab Screen Shot]]
| |
− | |}
| |
− | | |
− | = Talks =
| |
− | [[Image:zap128x128.png|right]]
| |
− | <div style="font-size:120%;border:none;margin: 0;color:#000">
| |
− | {{:Projects/OWASP Zed Attack Proxy Project/Pages/Talks | Talks}}
| |
− | | |
− | | |
− | </div>
| |
− | = News =
| |
− | [[Image:zap128x128.png|right]]
| |
− | <div style="font-size:120%;border:none;margin: 0;color:#000">
| |
− | {{:Projects/OWASP Zed Attack Proxy Project/Pages/News | News}}
| |
− | | |
− | </div>
| |
− | = ZAP Gear =
| |
− | [[Image:zap128x128.png|right]]
| |
− | <div style="font-size:120%;border:none;margin: 0;color:#000">
| |
− | | |
− | Yes, you can now buy ZAP related gear!
| |
− | | |
− | Its your chance to show your support for the project, c/o `CafePress`.
| |
− | | |
− | Click on the tshirt to enter the [http://www.cafepress.com/zaproxy ZAP Gear Store]:
| |
− | | |
− | [[Image:zap-tshirt-cp.PNG | link=http://www.cafepress.com/zaproxy]]
| |
− | | |
− | </div>
| |
− | = Sponsors =
| |
− | [[Image:zap128x128.png|right]]
| |
− | <div style="font-size:120%;border:none;margin: 0;color:#000">
| |
− | | |
− | ZAP is developed by a worldwide [http://code.google.com/p/zaproxy/people/list team] of volunteers.
| |
− | | |
− | But we have also been helped by many organizations, either financially or by encouraging their employees to work on ZAP:
| |
− | | |
− | * [http://www.owasp.org OWASP]
| |
− | * [http://www.mozilla.org Mozilla]
| |
− | * [http://www.sage.co.uk Sage]
| |
− | * [http://www.google.com Google]
| |
− | * [http://www.microsoft.com Microsoft]
| |
− | * [http://www.hacktics.com/ Hacktics, Ernst & Young]
| |
− | * [http://www.dinosec.com/ DinoSec]
| |
− | * [http://www.denimgroup.com Denim Group]
| |
− | * [http://www.aspectsecurity.com/ Aspect Security]
| |
− | * [http://secureideas.net SecureIdeas]
| |
− | * [http://utilisec.com UtiliSec]
| |
− | * [http://www.encription.co.uk/ encription]
| |
− | </div>
| |
− | = Functionality =
| |
− | [[Image:zap128x128.png|right]]
| |
− | <div style="font-size:120%;border:none;margin: 0;color:#000">
| |
− | '''Some of ZAP's functionality:'''
| |
− | | |
− | * [http://code.google.com/p/zaproxy/wiki/HelpStartConceptsIntercept Intercepting Proxy]
| |
− | * [http://code.google.com/p/zaproxy/wiki/HelpStartConceptsSpider Traditional] and AJAX spiders
| |
− | * [http://code.google.com/p/zaproxy/wiki/HelpStartConceptsAscan Automated scanner]
| |
− | * [http://code.google.com/p/zaproxy/wiki/HelpStartConceptsPscan Passive scanner]
| |
− | * [http://code.google.com/p/zaproxy/wiki/HelpStartConceptsBruteforce Forced browsing]
| |
− | * [http://code.google.com/p/zaproxy/wiki/HelpStartConceptsFuzz Fuzzer]
| |
− | * [http://code.google.com/p/zaproxy/wiki/HelpUiDialogsOptionsDynsslcert Dynamic SSL certificates]
| |
− | * [http://code.google.com/p/zaproxy/wiki/SmartCards Smartcard and Client Digital Certificates support]
| |
− | * [http://code.google.com/p/zaproxy/wiki/HelpAddonsWebsocketIntroduction Web sockets] support
| |
− | * [http://code.google.com/p/zaproxy/wiki/HelpAddonsScriptsScripts Support for a wide range of scripting languages]
| |
− | * [http://code.google.com/p/zaproxy/wiki/HelpAddonsPlugnhackPlugnhack Plug-n-Hack support]
| |
− | * Authentication and session support
| |
− | * [http://code.google.com/p/zaproxy/wiki/HelpStartConceptsApi Powerful REST based API]
| |
− | * Automatic updating option
| |
− | * [https://code.google.com/p/zap-extensions/ Integrated and growing marketplace of add-ons]
| |
− | | |
− | </div>
| |
− | = Features =
| |
− | [[Image:zap128x128.png|right]]
| |
− | <div style="font-size:120%;border:none;margin: 0;color:#000">
| |
− | '''Some of ZAP's features:'''
| |
− | | |
− | * [http://www.apache.org/licenses/LICENSE-2.0 Open source]
| |
− | * Cross platform
| |
− | * Easy to install (just requires java 1.7)
| |
− | * Completely free (no paid for 'Pro' version)
| |
− | * Ease of use a priority
| |
− | * [http://code.google.com/p/zaproxy/wiki/HelpIntro Comprehensive help pages]
| |
− | * Fully internationalized
| |
− | * Translated into over 20 languages
| |
− | * Community based, with involvement actively encouraged
| |
− | * Under active development by an international team of volunteers
| |
− | | |
− | ZAP is a fork of the well regarded [http://www.parosproxy.org/ Paros Proxy].
| |
− | | |
− | </div>
| |
− | = Languages =
| |
− | [[Image:zap128x128.png|right]]
| |
− | <div style="font-size:120%;border:none;margin: 0;color:#000"> | |
− | | |
− | '''ZAP supports the following languages:'''
| |
− | | |
− | * English
| |
− | * Arabic
| |
− | * Bosnian
| |
− | * Brazilian Portuguese
| |
− | * Chinese
| |
− | * Danish
| |
− | * Filipino
| |
− | * French
| |
− | * German
| |
− | * Greek
| |
− | * Indonesian
| |
− | * Italian
| |
− | * Japanese
| |
− | * Korean
| |
− | * Persian
| |
− | * Polish
| |
− | * Russian
| |
− | * Sinhala
| |
− | * Spanish
| |
− | * Urdu
| |
− | | |
− | You can use [http://crowdin.net/project/owasp-zap Crowdin] to help improve these translations or add new ones right now!
| |
− | | |
− | </div>
| |
− | = Roadmap =
| |
− | [[Image:zap128x128.png|right]]
| |
− | <div style="font-size:120%;border:none;margin: 0;color:#000">
| |
− | | |
− | ==Release 2.3.0==
| |
− | ZAP 2.3.0 has been released, which includes:
| |
− | * A ZAP 'lite' version in addition to the existing 'full' version
| |
− | * View, intercept, manipulate, resend and fuzz client-side (browser) events
| |
− | * Enhanced authentication support
| |
− | * Support for non standard apps
| |
− | * Input Vector scripts
| |
− | * Scan policy - fine grained control
| |
− | * Advanced Scan dialog
| |
− | * Extended command line options
| |
− | * More API support
| |
− | * Internationalized help file
| |
− | * Keyboard shortcuts
| |
− | * New UI options
| |
− | * More functionality moved to add-ons
| |
− | * New and improved active and passive scanning rules
| |
− | | |
− | For more details see http://code.google.com/p/zaproxy/wiki/HelpReleases2_3_0
| |
− | | |
− | ==Release 2.4.0==
| |
− | | |
− | The major features we are currently working on include:
| |
− | * Client side scanning
| |
− | * Advanced fuzzing
| |
− | * Advanced access control testing
| |
− | * SOAP service scanning
| |
− | * Sequence scanning
| |
− | * Sequence detection
| |
− | | |
− | The date and exact features that will be included in 2.4 have not been finalized.
| |
− | | |
− | </div>
| |
− | = Get Involved =
| |
− | [[Image:zap128x128.png|right]]
| |
− | <div style="font-size:120%;border:none;margin: 0;color:#000">
| |
− | | |
− | Involvement in the development of ZAP is actively encouraged!
| |
− | | |
− | You do not have to be a security expert in order to contribute.
| |
− | | |
− | Some of the ways you can help:
| |
− | | |
− | ==Feature Requests==
| |
− | | |
− | Please raise new feature requests as enhancement requests here: http://code.google.com/p/zaproxy/issues/list
| |
− | | |
− | If there are existing requests you are also interested in then please 'star' them - that way we can see which features people are most interested in and can prioritize them accordingly.
| |
− | | |
− | ==Feedback==
| |
− | | |
− | Please use the [http://groups.google.com/group/zaproxy-users zaproxy-users Google Group] for feedback:
| |
− | * What do like?
| |
− | * What don't you like?
| |
− | * What features could be made easier to use?
| |
− | * How could the help pages be improved?
| |
− | | |
− | ==Log issues==
| |
− | | |
− | Have you had a problem using ZAP?
| |
− | | |
− | If so and its not already been logged then please [http://code.google.com/p/zaproxy/issues/list report it]
| |
− | | |
− | ==Localization==
| |
− | | |
− | Are you fluent in another language? Can you help translate ZAP into that language?
| |
− | | |
− | You can use [http://crowdin.net/project/owasp-zap Crowdin] to do that!
| |
− | | |
− | ==Development==
| |
− | | |
− | If you fancy having a go at adding functionality to ZAP then please get in touch via the [http://groups.google.com/group/zaproxy-develop zaproxy-develop Google Group].
| |
− | | |
− | Again, you do not have to be a security expert to contribute code - working on ZAP could be great way to learn more about web application security!
| |
− | | |
− | If you actively contribute to ZAP then you will be invited to join the project.
| |
| | | |
| </div> | | </div> |
− | = Project About =
| |
− | <div style="font-size:120%;border:none;margin: 0;color:#000">
| |
− | [[Image:zap128x128.png|right]]
| |
− | {{:Projects/OWASP Zed Attack Proxy Project | Project About}}
| |
− |
| |
− |
| |
− | __NOTOC__ <headertabs />
| |
| | | |
− | [[Category:OWASP_Project|Zed Attack Proxy Project]] | + | __NOTOC__ |
| + | [[Category:OWASP Project|Zed Attack Proxy Project]] |
| [[Category:OWASP_Tool]] | | [[Category:OWASP_Tool]] |
− | [[Category:OWASP_Release_Quality_Tool|OWASP Release Quality Tool]] | + | [[Category:OWASP Release Quality Tool|OWASP Release Quality Tool]] |
| [[Category:OWASP_Download]] | | [[Category:OWASP_Download]] |
| [[Category:Popular]] | | [[Category:Popular]] |
| + | [[Category:SAMM-ST-2]] |
| + | [[Category:Flagship Projects|Zap]] |
| + | [[Category:OWASP Zed Attack Proxy|Zap]] |