ZAP Scans on ZAP

ZAP Authentication Tests

Mon, 01 Jan 0001 00:00:00 +0000

Testing ZAP authentication handling against a range of test and real world applications.

Columns:

Type:
- stdbba: Standard Browser Based Authentication, just the login URL and credentials, no additional configuration
- bbaplus: Browser Based Authentication with some additional configuration
- csa: Client Script Authentication, using a client side Zest script to authenticate
Auth: Did ZAP succeed in authentication to this site? This is the key column
Username: Did ZAP find the username field? Only applicable to Browser Based Auth
Password: Did ZAP find the password field? Only applicable to Browser Based Auth
Session Mgmt: Did ZAP identify the session management method?
Verification: Did ZAP identify a suitable verification URL?

Site	Type	Auth	Username	Password	Session Mgmt	Verification	Note
http://aspnet.testsparker.com	stdbba	✓ Passed	✓	✓	✓	✓
https://authenticationtest.com/complexAuth/	bbaplus	✓ Passed	✓	✓	✓	✓
https://authenticationtest.com/complexAuth/	stdbba	❌ Failed	✓	✓	✓	❌
https://authenticationtest.com/delayChallenge/	bbaplus	❌ Failed	✓	✓	✓	✓
https://authenticationtest.com/delayChallenge/	stdbba	❌ Failed	✓	✓	✓	❌
https://authenticationtest.com/simpleFormAuth/	bbaplus	✓ Passed	✓	✓	✓	✓
https://authenticationtest.com/simpleFormAuth/	stdbba	❌ Failed	✓	✓	✓	❌
https://authenticationtest.com/totpChallenge/	bbaplus	✓ Passed	✓	✓	✓	✓
https://authenticationtest.com/totpChallenge/	stdbba	❌ Failed	✓	✓	✓	❌
https://bsky.app	stdbba	✓ Passed	✓	✓	✓	✓	BBA is failing verification detection.
https://ctflearn.com	stdbba	✓ Passed	✓	✓	✓	✓
https://ginandjuice.shop	stdbba	✓ Passed	✓	✓	✓	✓
https://hack-yourself-first.com	stdbba	❌ Failed	✓	✓	✓	❌
https://infosec.exchange	stdbba	✓ Passed	✓	✓	✓	✓
https://www.instagram.com	stdbba	❌ Failed	✓	✓	✓	✓	BBA is failing due to popups.
https://www.linkedin.com	stdbba	✓ Passed	✓	✓	✓	✓
https://bugzilla.mozilla.org	stdbba	✓ Passed	✓	✓	✓	✓
http://php.testsparker.com	stdbba	✓ Passed	✓	✓	✓	✓
https://www.reddit.com	stdbba	❌ Failed	✓	✓	✓	✓
http://testasp.vulnweb.com	stdbba	✓ Passed	✓	✓	✓	✓
http://testfire.net	bbaplus	✓ Passed	✓	✓	✓	✓
http://testfire.net	csa	✓ Passed	—	—	✓	✓
http://testfire.net	stdbba	✓ Passed	✓	✓	✓	✓
http://testhtml5.vulnweb.com	stdbba	❌ Failed	✓	✓	❌	✓
http://testphp.vulnweb.com	stdbba	✓ Passed	✓	✓	✓	✓
https://en.wikipedia.org	stdbba	✓ Passed	✓	✓	✓	✓
https://zoom.us	stdbba	✓ Passed	✓	✓	✓	✓	BBA is failing due to popups.

Configuration

Config	Details
Frequency	Daily & On-demand
Scripts	https://github.com/zapbot/zap-mgmt-scripts/blob/master/scans/auth/
Action	https://github.com/zapbot/zap-mgmt-scripts/blob/master/.github/workflows/auth-tests.yml

Settings

The latest Nightly ZAP Docker image is run with the default settings against these apps with no exceptions.

ZAP vs Firing Range

Mon, 01 Jan 0001 00:00:00 +0000

Google Firing Range is a test bed for automated web application security scanners.

It is available online at https://public-firing-range.appspot.com/ and the GitHub repo is https://github.com/google/firing-range

It does not appear to be being actively maintained and some of the tests no longer appear to work with modern browsers.

Tests which we are sure are no longer valid are marked: “⚠️ No vuln” - if you can prove otherwise then please let us know!

ZAP vs OWASP Benchmark

Mon, 01 Jan 0001 00:00:00 +0000

OWASP Benchmark is a Java test suite designed to verify the speed and accuracy of vulnerability detection tools.

You can find the home page for the project at https://owasp.org/www-project-benchmark/ and the source code at https://github.com/OWASP-Benchmark/BenchmarkJava.

Click on the Sections to see the full set of results, which include the path of the test in the application and the scan rule which should find the vulnerability.

ZAP vs OWASP Juice Shop

Mon, 01 Jan 0001 00:00:00 +0000

OWASP Juice Shop is “probably the most modern and sophisticated insecure web application!”.

The main project page is https://owasp.org/www-project-juice-shop/

It is actively maintained.

In this case we use it to check that the AJAX Spider finds all of the expected pages. Juice Shop was manually explored using a browser - if you find a new URL in Juice Shop that can be discovered by ’normal' exploration but which is not listed then please raise an issue.

ZAP vs Security Crawl Maze

Mon, 01 Jan 0001 00:00:00 +0000

Google Security Crawl Maze is a comprehensive testbed for web security crawlers.

It is available online at https://security-crawl-maze.app/ and the GitHub repo is https://github.com/google/security-crawl-maze It does appear to be being actively maintained and has merged a fix that we submitted.

As long as one of the ZAP spiders finds the relevant page we count that as a pass, but ideally both spiders will find as many of the URLs as possible.

ZAP vs WAVSEP

Mon, 01 Jan 0001 00:00:00 +0000

WAVSEP is a vulnerable web application designed to help assessing the features, quality and accuracy of web application vulnerability scanners.

It is the most comprehensive OSS DAST specific test suite that we know of.

This version of WAVSEP is now maintained by the ZAP Team: https://github.com/zaproxy/wavsep

Click on the Sections to see the full set of results, which also give the local URL and the scan rule which should find the vulnerability.

ZAP vs Webseclab

Mon, 01 Jan 0001 00:00:00 +0000

Yahoo Webseclab is a set of web security test cases and a toolkit to construct new ones. It can be used for testing security scanners, to replicate or reconstruct issues, or to help with investigations or discussions of particular types of web security bugs.

It is not available online, the GitHub repo is https://github.com/yahoo/webseclab

ZAP vs Websites Vulnerable to SSTI

Mon, 01 Jan 0001 00:00:00 +0000

Websites Vulnerable to SSTI is a set of simple servers which are vulnerable to Server Side Template Injection.

It is not available online, the GitHub repo is https://github.com/DiogoMRSilva/websitesVulnerableToSSTI It is actively maintained by a ZAP contributor: Diogo Silva.

The vulnerabilities are reported by various ZAP scan rules - if any of them find a vulnerability then we count that as a pass.