OWASP ZAP LAB REPORT
In this task, I used OWASP ZAP to identify and study the login endpoint of the web application. I first configured the browser to pass through the ZAP proxy and accessed the application. I used the Spider feature to discover the pages available on the website.
After locating the login page, I checked the request captured in the History tab. I examined the HTTP request to understand the URL, HTTP method, and the information submitted by the login form. I also checked the request for fields such as the username, password, hidden fields, and possible anti-CSRF tokens.
This task helped me understand how a web application’s login form communicates with the server and how ZAP can be used to observe and analyze HTTP requests.
Capture a Login Request and Send to Fuzzer
For this task, I captured a login request by submitting login details through the browser while ZAP was running. I then opened the captured request from the History tab and used the Attack → Fuzz option.
I selected the password field as the fuzzing location and used a small list of test passwords as the payload. The Fuzzer sent different requests automatically, and I compared the responses to identify any differences in the status codes or response lengths.
The task helped me understand how ZAP’s Fuzzer can be used for controlled testing of login forms. I learned how to capture a request, select a parameter for testing, and analyze the responses returned by the application.