Instructor: So far we learnt how to manually discover 2 2
a number of very dangerous vulnerabilities. 3 3
We seen how they work and how to exploit them. 4 4
In today's video, I'd like to show you a tool 5 5
that will allow you to automatically discover 6 6
vulnerabilities in web applications. 7 7
It will allow you to discover the vulnerabilities 8 8
that we learned, plus much more. 9 9
The reason why I didn't teach you this at the start, 10 10
because I wanted you to learn how to do it manually, 11 11
and I also wanted you to know 12 12
how this vulnerabilities occur, 13 13
so to understand the reason behind them. 14 14
Also this are just tools, 15 15
so this program is just a tool, 16 16
it can make mistakes and it can show false positives. 17 17
It can also miss vulnerabilities in some cases. 18 18
Therefore, I wanted you to know 19 19
how to do this stuff manually, 20 20
so if the program doesn't work 21 21
or if the program misses something, 22 22
then you'll be able to find it. 23 23
The best way to use these programs is as a back up 24 24
or as just a tool to help you with your penetration testing. 25 25
So using the tool is very simple. 26 26
I'm gonna go on my applications 27 27
and then I'm gonna type in ZAP. 28 28
And it's asking me if I wanted to save the current session 29 29
when I search for something, so I'm gonna say no. 30 30
And this is the main view of the tool, 31 31
so on the left here you'll see the websites 32 32
that you're targeting. 33 33
On the right, you can attack and send the website URL, 34 34
and in here you'll see the results for your attacking 35 35
or for your scan. 36 36
If we go here on the cog on the left, 37 37
it'll allow you to modify the options for the program. 38 38
So you can modify certain aspects of it, 39 39
the way the fuzzer works, the way the spider works, 40 40
the way the scan works. 41 41
I'm gonna leave everything the same. 42 42
Another thing that you can modify 43 43
is the policies used in this scan, 44 44
so it's something similar to these scans 45 45
that we we're using with andmap, 46 46
the intense scan and all of that. 47 47
So I'm gonna press on the plus, 48 48
I'm gonna press on the active scan, 49 49
and if you press on this, 50 50
on the left here, 51 51
and I'm gonna press under default policy, 52 52
now you can create your own policies 53 53
by using the add button, 54 54
I'm gonna press on the default one 55 55
and I'm gonna go on modify 56 56
to show you the aspects that you can modify. 57 57
So right here we can modify the name, 58 58
the threshold and the strength for the global policy. 59 59
Click in on each of these categories 60 60
will allow you to modify the specific scans 61 61
that will be performed. 62 62
For example, in the injection tab here, 63 63
we can see all the injection scans 64 64
that the program is going to try. 65 65
For example, we can see SQL injections here, 66 66
we can see Cross-site scripting here, 67 67
and pressing on the threshold right here 68 68
we can set this to default, low, medium or high. 69 69
Setting it to the default 70 70
will just default to the value selected here 71 71
which is medium right now, 72 72
or you can have for example, 73 73
if SQL injection is what you're looking for, 74 74
if what you're looking for is access from the database, 75 75
then you can set this to high 76 76
so that it'll try everything 77 77
and it'll try to find it in even difficult places. 78 78
So I'm gonna close all of this 79 79
I'm leaving everything the same, 80 80
and I'm gonna start my attack against the mutillidae script, 81 81
so we have it in 10.20.14.204 82 82
running in metasploitable machine, 83 83
and if we go on Mutillidae right here, 84 84
that's the URL, 85 85
so literally I'm just gonna copy this, 86 86
and paste it here, 87 87
And then I'm gonna attack. 88 88
Now the tool is first gonna try to find all the URL's 89 89
and then it's going to try and attack this URL's 90 90
based on the scan policy that we used. 91 91
I'm gonna pause the video 92 92
and resume it once the scan is over.