As part of the practical cybersecurity exercise, I was introduced to two security tools, OWASP ZAP (Zed Attack Proxy) and Wireshark. The purpose of the exercise was to understand how these tools are used to examine web applications and analyze network traffic.
Task 1: Using OWASP ZAPFor the first part of the practical, I used OWASP ZAP to examine a web application in an authorized testing environment. I configured the tool and observed the communication between the browser and the web application.During the exercise, I used ZAP to crawl the application and identify its available pages and resources. I also intercepted and examined HTTP requests and responses to understand the information being exchanged between the client and server.I performed a security scan to check for possible vulnerabilities and reviewed the alerts produced by the tool. I also examined information such as cookies, headers, parameters, and response codes. Finally, I reviewed the security findings and used the results to understand areas where the web application could be improved.
Task 2: Using WiresharkFor the second part of the practical, I used Wireshark to capture and analyze network traffic. I selected the appropriate network interface and started a packet capture while network communication was taking place.I examined the captured packets and identified different protocols, including TCP, UDP, DNS, HTTP, and ICMP. I also looked at source and destination IP addresses, port numbers, packet information, and communication between different devices.I used Wireshark’s filtering feature to focus on specific types of traffic. This made it easier to examine individual connections and understand how data moves across a network. The exercise also showed me how Wireshark can be used to troubleshoot network problems and investigate unusual network activity.
Things I used OWASP ZAP to do
1.Scan websites for vulnerabilities to know the common security weaknesses in the website 2.intercept HTTP/HTTPS traffic to enable me sit between browser and a web application and allow me to inspect, requests and responses.
3.spider/crawl a website it helps me to automatically discover pages, links, forms, and other resources in a web application.
4.Passive security scanning i used it to examine traffic without actively attacking the application and identify potential security problems
5.Active security scanning: In an authorized test environment, I use ZAP to send specially crafted requests to test whether vulnerabilities are exploitable.
6.Find common web vulnerabilities I use it to identify issues such as:Cross-Site Scripting (XSS),SQL injection indicators, Missing security headers, Authentication and session-related weaknesses, Insecure cookies, Information disclosure
7. Analyze HTTP requests and responses I examine the methods such as GET, POST, PUT, and DELETE, together with headers, parameters, cookies, and response codes.
8. Test APIs I use ZAP to inspect and test web APIs, including REST-based applications
9. Modify requests: During authorized testing, I use ZAP to change request before they reach the server to determine how the application responds to different inputs
10. Test authentication and sessions: I used it to examine login mechanisms, session cookies, authentication flows, and access-control behavior
11. Generate security reports: I also use ZAP to produce reports containing discovered alerts and information useful for documenting vulnerabilities
12. Automate security testing I incorporated ZAP into security-testing and CI/CD workflows so applications can be checked regularly.
Things I used Wireshark to do
- Capture network traffic I recorded packets moving through a network interface
- Analyze packets: I examined individual packets and see information contained in different protocol layers.
- Troubleshoot network problems: II used it to identify problems such as failed connections, retransmissions, packet loss, and unusual traffic.
- Analyze network protocols: I used it to capture analysis of many protocols, including:TCP, UDP, IP, DNS, HTTP, TLS, DHCPI, CMP, ARP
- Monitor DNS traffic: I used it to investigate DNS requests and responses to understand how domain names are being resolved.
- Analyze TCP connections: I used it to showcase TCP handshakes, connections, acknowledgements, retransmissions, and connection termination.
- Identify communication between devices: I used it to determine which IP addresses and ports are communicating with one another.
- Investigate network security incidents: I used it as a security analysis to captured traffic for suspicious or abnormal communication.
- Detect unusual network behavior: I used it to investigate unexpected connections, protocols, ports, or traffic patterns.
- Analyze HTTP traffic: Where traffic is unencrypted, I used wireshark to show HTTP requests, responses, URLs, headers, and other information.
- Examine encrypted traffic metadata: Even when traffic is encrypted, I used wireshark to still provide useful information about connections, addresses, ports, packet sizes, timing, and TLS activity.
- Filter network traffic: I used it in displaying filters to focus on particular protocols, IP addresses, ports, conversations, or packets.
- Follow network conversations: I reconstructed and examined communication between network endpoints where the captured traffic permits it.
- Analyze performance: I used it to identify latency, retransmissions, excessive traffic, and other performance-related problems.
- Export and document captured data: I saved captured packet to analyzed later for investigation or reporting.