OWASP ZAP – My Learning Experience. During my cybersecurity training, I learned the fundamentals of OWASP ZAP, a web application security testing tool used to identify and understand potential vulnerabilities in web applications.I learned how to connect a browser to ZAP, use the Spider to discover website pages, and examine HTTP requests and responses, including login-related requests. I was also introduced to important security concepts such as fuzzing, rate limiting, account lockout, username enumeration, active scanning, and session/cookie security.This experience has helped me understand how web applications communicate and how security testing can be used to identify weaknesses in an authorized lab environment. I am continuing to improve my practical skills, particularly with the Fuzzer and other ZAP features.
Web Application Security Concepts. During my learning, I was introduced to several important web security concepts, including:Rate limiting – controlling how many requests a user can make within a period of time.Account lockout – protecting accounts by temporarily restricting access after repeated failed login attempts.Username enumeration – understanding how differences in application responses can sometimes reveal whether a username exists.Active Scanning – using ZAP to actively test a web application for potential security weaknesses.Sessions and cookies – understanding how websites maintain user sessions and how poorly protected cookies can create security risks.