OWASP Zed Attack Proxy Project

취약점과 관련하여 OWASP를 보다가 Zed Attack Proxy Project를 확인했다.  ZAP.

인터페이스가 복잡하긴 하지만  공개용 웹취약점 점검툴로는 손색이 없다고 생각된다.

특히 Injection을 위한 Fuzz 기능은 매우 유용하게 사용할 수 있을 듯!

The Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications.

It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing.

ZAP provides automated scanners as well as a set of tools that allow you to find security vulnerabilities manually.

Want to help us make ZAP even better for you?

Just fill in the ZAP User Questionnaire which is available in English, French and Spanish!

You can view the responses so far (which are separate for each languages) here: English, French, Spanish

Overview

Overview of Version 2.0.0

Initial Setup Guide

Using ZAP for security testing in Development and QA

A1: Injection

ZAP and Threadfix