12 Days of ZAPmas – Day 12 Testing a new Content-Security-Policy

This final day closes out the series with a look at using ZAP to test and refine a Content-Security-Policy (without breaking your app).

Twelve Days of ZAPmas – Day 9 – Automated Scanning and ATTACK mode

Day 9 of the series digs into ZAP’s automated scanning capabilities.

Twelve Days of ZAPmas – Day 7 – API Testing with Postman and ZAP

Day 7 of the series sets up Postman to proxy through Zed Attack Proxy, and explains why I prefer this setup for my API testing.

Twelve Days of ZAPmas – Day 5 – Scope and Contexts

Day 5 of the series goes over the use of ZAP’s contexts and scope specifier to keep your attacks in-scope.

Twelve Days of ZAPMAS – Day 6 – Passive Flaw Detection and Using the HUD

Day 6 of the series looks at ZAP’s use of passive detection rules to identify problems, and it’s injectable head’s up display (HUD).

Twelve Days of ZAPmas – Day 4 – Fuzzing for Injection

The fourth day of the series introduces using ZAP’s Fuzzer tool to fuzz for injection flaws in the client (XSS) and server.

Twelve Days of ZAPmas – Day 3 – CYA (Cover Your Auth)

The third entry in the Twelve Days of ZAPmas series deals with using Zed Attack Proxy’s request tampering to check if your authorization controls work.

Twelve Days of ZAPmas – Day 2 – The Edge of Tomorrow

This second post in the 12 day series uses OWASP Zed Attack Proxy to modify and replay traffic we captured on day 1.

Twelve Days of ZAPmas – Day 1 – Setting Up ZAP

This post kicks off the 12 day series by setting up OWASP Zed Attack Proxy and walks through the manual steps to setup Chrome or Firefox to proxy through.

Coming Soon – Twelve Days of ZAPmas

This announcement teases the upcoming (December 2022) series providing an onramp for developers and QA specialists to start using OWASP Zed Attack Proxy.