OWASP ZAP PRACTICAL REPORT
Task 1: Spider and Map the Login Endpoint
The first task involved using OWASP ZAP to find the authentication or login endpoint of the target web application. I connected the browser to ZAP’s proxy and navigated through the application.
Using the Spider feature, I was able to discover the pages of the application and locate the login page. I then used the History tab to view the request generated when the login form was submitted.
I examined the request to determine whether it used GET or POST and identified the different parameters sent to the server, especially the username and password fields. I also looked for hidden security information such as CSRF tokens.
From this exercise, I learned how to map a web application and inspect the structure of login requests using OWASP ZAP.
Task 2: Capture a Login Request and Send to Fuzzer
In the second task, I used ZAP to capture a login attempt from the web application. After locating the request in the History tab, I opened the Fuzzer through the Attack → Fuzz option.
The password parameter was selected as the area to be tested. A small custom wordlist was provided as the input for the Fuzzer. ZAP then generated multiple requests using the different values from the wordlist.
I reviewed the responses produced by the application and compared their status codes and response sizes to see whether any response was different from the usual failed-login response.
This exercise gave me practical experience with the ZAP Fuzzer and showed me how automated testing can be used to examine the security of a login mechanism in an authorized laboratory environment.