Cybersecurity involves protecting computer systems, networks, applications, and data from different forms of security threats. There are several tools used by cybersecurity professionals to identify and investigate these threats. Two important tools are OWASP ZAP and Wireshark.
As part of the practical cybersecurity exercise, I was introduced to two security tools, OWASP ZAP (Zed Attack Proxy) and Wireshark. The purpose of the exercise was to understand how these tools are used to examine web applications and analyze network traffic.
Wireshark is a network protocol analyzer. It captures network packets and allows you to examine how devices communicate across a network.
WHAT I USED WIRESHARK FOR
For the first part of the practical, I used Wireshark to capture and analyze network traffic. I selected the appropriate network interface and started a packet capture while network communication was taking place. I examined the captured packets and identified different protocols, including TCP, UDP, DNS, HTTP, and ICMP. I also looked at source and destination IP addresses, port numbers, packet information, and communication between different devices.
- I captured network traffic of packets moving through a network interface.
- I analyze the packets captured
- I troubleshoot network problems to help me identify problems such as failed connections, retransmissions, packet loss, and unusual traffic.
- I analyzed network protocols including:TCP, UDP, IP, DNS, HTTP, TLS, DHCP, ICMP, ARP
- I investigate DNS requests and responses to understand how domain names are being resolved.
- I analyzed TCP connections to show TCP handshakes, connections, acknowledgements, retransmissions, and connection termination
- I Identify communication between devices to determine which IP addresses and ports are communicating with one another.
- I Investigated network security incidents to examine captured traffic for suspicious or abnormal communication.
- I investigated unexpected connections, protocols, ports, or traffic patterns can be investigated.
- I analyzed HTTP where traffic is unencrypted to show HTTP requests, responses, URLs, headers, and other information.
- I examined encrypted traffic metadata even when traffic is encrypted to provide useful information about connections, addresses, ports, packet sizes, timing, and TLS activity
- I filtered network traffic display to allow me focus on particular protocols, IP addresses, ports, conversations, or packets
- I followed network conversations to reconstruct and examine communication between network endpoints where the captured traffic permits it.
- I analyzed performance to he me identify latency, retransmissions, excessive traffic, and other performance-related problems
- I exported and documented captured data and saved for later investigation or reporting.
OWASP ZAP also known as Zed Attack Proxy is a security testing tool mainly used for checking web applications while Wireshark, on the other hand, is a network protocol analyzer used to capture and examine network traffic
WHAT I USED OWASP ZAP FOR
For the second part of the practical, I used OWASP ZAP to examine a web application in an authorized testing environment. I configured the tool and observed the communication between the browser and the web application.During the exercise, I used ZAP to crawl the application and identify its available pages and resources. I also intercepted and examined HTTP requests and responses to understand the information being exchanged between the client and server.I performed a security scan to check for possible vulnerabilities and reviewed the alerts produced by the tool. I also examined information such as cookies, headers, parameters, and response codes. Finally, I reviewed the security findings and used the results to understand areas where the web application could be improved.
- I scanned websites for vulnerabilities
- I intercept HTTP/HTTPS traffic
- I Spidered a website to discover pages, links, forms, and other resources in a web application.
- I used passive security scanning
- I also used active security scanning in an authorized test environment
- I looked for the common web vulnerabilities in the website
- I analyzey HTTP requests and responses
- I inspect and test web APIs, including REST-based applications.
- I modified requests during authorized testing,
- I test authentication and sessions
- I generated security reports containing discovered alerts and information useful for documenting vulnerabilities.
- I automate security-testing and CI/CD workflows