OWASP ZAP

OWASP ZAP is a complex and reliable piece of software functioning as a penetration testing tool that aims to detect the potential vulnerabilities in your web application.

Following a simple installation process with no noteworthy events, you can run this penetration testing tool and begin working with it. The program features a wide array of components that can help you determine the security risks of various weaknesses in your online application.

OWASP ZAP offers a comprehensive, yet a bit overly-cluttered interface, with multiple tabs for the several functions that it is capable of fulfilling. However, it is sufficiently simple to use, even for the less experienced, as its initial steps require only beginner knowledge.

In order to start testing a web application, you first need to enter its corresponding URL address, then click on the 'Attack' button, which will start the operation and retrieve the first results within moments. All the recovered information is displayed in a lower panel, while the multiple tabs allow you to browse through all the data, and work only with what interests you.

In the 'Alerts' section, you will be able to view each individual vulnerability that OWASP ZAP detected, along with its name, URL address, risk level, reliability and parameter, a brief description or other information. Moreover, the tool also displays a possible solution to the problem, helping you remove any risk of having your web application exploited.

Other components included by OWASP ZAP are the 'Spider' (with several options, such as 'Spider Context', 'Spider Site', 'Spider Subtree' or 'Spider URL'), the 'Fuzzer', which can be used to send invalid data to a specific target, and others.

To conclude, OWASP ZAP is and advanced and intuitive utility that enables you to run penetration tests, in the attempt of discovering security risks or weak points in your online application.