OWASP ZAP PRACTICAL REPORT
Task 1: Spider and Map the Login EndpointThe first task involved using OWASP ZAP to find the authentication or login endpoint of the target web application. I connected the browser to ZAP’s proxy and navigated through the application.Using the Spider feature, I was able to discover the pages of the application and locate the login page. I then used the History tab to view the request generated when the login form was submitted.I examined the request to determine whether it used GET or POST and identified the different parameters sent to the server, especially the username and password fields. I also looked for hidden security information such as CSRF tokens.From this exercise, I learned how to map a web application and inspect the structure of login requests using OWASP ZAP
.Task 2: Capture a Login Request and Send to FuzzerIn the second task, I used ZAP to capture a login attempt from the web application. After locating the request in the History tab, I opened the Fuzzer through the Attack → Fuzz option.The password parameter was selected as the area to be tested. A small custom wordlist was provided as the input for the Fuzzer. ZAP then generated multiple requests using the different values from the wordlist.I reviewed the responses produced by the application and compared their status codes and response sizes to see whether any response was different from the usual failed-login response.This exercise gave me practical experience with the ZAP Fuzzer and showed me how automated testing can be used to examine the security of a login mechanism in an authorized laboratory environment.