OWASP ZAP HANDS-ON LAB REPORT
Spider and Map the Login Endpoint
For this task, I used OWASP ZAP to understand how the login page of the web application works. I started by setting my browser to use the ZAP proxy and then opened the target application.
I used the Spider feature to go through the website and identify the different pages available. While doing this, I located the login page and checked the request that was captured by ZAP in the History tab.
I looked closely at the HTTP request to understand where the login information was being sent and which method was being used. I also checked the fields submitted by the login form, especially the username and password, and looked for any hidden fields or anti-CSRF tokens.
Personally, this task helped me understand something I had not really paid attention to before: what actually happens behind a login form when I click the login button. I also learned how ZAP can help me see and understand the requests being sent between the browser and the web application.
Task 2: Capture a Login Request and Send to Fuzzer
For the second task, I worked with the login request that I captured using OWASP ZAP. I first submitted a login attempt through the browser while the ZAP proxy was active. I then went to the History tab and found the captured login request.
From there, I selected Attack → Fuzz and focused on the password field as the part of the request I wanted to test. I added a small custom wordlist containing different password values and started the fuzzing process.
After the requests were sent, I looked through the results and compared the responses from the application. I paid attention to the HTTP status codes and response lengths to see if any response was different from the normal failed-login responses.
This task gave me a better understanding of how the ZAP Fuzzer works. At first, the process looked a little confusing to me, but after going through the steps, I understood that the Fuzzer can automatically test different inputs against a selected part of a request.