OWASP Zed Kurwisa Proxy

El Zed Kurwisa Proxy (ZAP) chishandiso chemahara chakanyorwa mu Java kuuya kubva OWASP chirongwa kuita, mune yekutanga chiitiko, bvunzo dzekupinda muwebhu webhu, kunyangwe ichigona zvakare kushandiswa nevanogadzira mune yavo yezuva nezuva basa. Kubva nhasi iri mune yayo vhezheni 2.1.0 uye zvido Java 7 kumhanya, kunyange ini ndichiishandisa mu Debian GNU / Linux pasi OpenJDK 7. Kune avo vedu vari kutanga munyika yewebhu application chengetedzo, chishandiso chakanakisa kupurinda hunyanzvi hwedu.

Pakati pezvinhu zvakawanda zve ZAP, Ini ndichataura pane zvinotevera:

• Kubatira proxy: Yakanakira isu vedu vari newbies mundima ino yekuchengetedza, yakagadzirirwa nenzira kwayo, inobvumidza kuona traffic yese pakati pebrowser newebhu webhu yenguva, ichiratidza nenzira yakapusa misoro nemuviri weHTTP mameseji zvisinei nemaitiro ashandiswa (HEAD, GET, POST, nezvimwewo). Mukuwedzera tinokwanisa chinja traffic yeHTTP paunoda munzira mbiri dzekutaurirana (pakati pewebhu dura uye bhurawuza).
• Dandemutande: Icho chinhu chinobatsira kutsvaga ma URL matsva pane saiti yakaongororwa. Imwe yenzira dzainoita izvi ndeyokuparadzanisa kodhi yeiyo peji reHTML kuti uwane ma tag. uye tevera hunhu hwavo href.
• Kumanikidzwa Kutsvaga: Inoedza kutsvaga isina-indexed mafaera uye madhairekitori pane ino saiti semapeji ekupinda. Kuti zvibudirire izvi, ine nekukanganisa nhevedzano yeduramazwi iyo yaizoshandisa kuita zvikumbiro kuseva yakamirira kodhi yemamiriro mhinduro 200.
• Anoshanda Scan: Inogadzira otomatiki akasiyana ekurwiswa kwewebhu kurwisa saiti senge CSRF, XSS, SQL Jekiseni pakati pevamwe.
• Uye vamwe vazhinji: Chaizvoizvo kune zvimwe zvakawanda zvinhu zvakaita se: Tsigiro yewebhu zvigadziko kubva mushanduro 2.0.0, AJAX Spider, Fuzzer, uye nevamwe vashoma.

Kugadziriswa neFirefox

Isu tinokwanisa kumisikidza iyo socket iyo iyo ZAP ichave ichiteerera kana tichizoenda Zvishandiso -> Sarudzo -> Yemunharaunda Proxy. Mune yangu nyaya ndinayo inoteerera pachiteshi 8018:

Kugadziridza «Proxy yemunharaunda»

Ipapo tinovhura zvido zveFirefox uye ticha Yepamberi -> Network -> Kugadziridza -> Chinyorwa proxy kumisikidza. Isu tinoratidzira masokisi atakambogadzira muZAP.

Gadzira proxy muFirefox

Kana zvese zvikafamba mushe, tinenge tichitumira yedu yese yeHTTP traffic kuZAP uye ichave iri mutariri wekuidzorera sezvinoita chero proxy yaizoita. Semuenzaniso, ini ndinopinda iyi blog kubva kubhurawuza uye ndoona zvinoitika muZAP:

ZAP kuongorora

Tinogona kuona kuti anopfuura zana zana maHTTP akagadzirwa (mazhinji achishandisa nzira yeGET) kurodha zvizere peji. Sezvatinoona mune iyo tebhu Nzvimbo Kwete chete traffic yakaunzwa kune ino blog, asiwo kune mamwe mapeji. Imwe yadzo ndeye Facebook uye inogadzirwa neyekudyidzana plugin pazasi peji «Titevere paFacebook ". Zvakare akaita Google Analytics iyo inoratidza kuvepo kwechataurwa chishandiso chekuongorora uye kuona kwehuwandu hweiyi blog nevakuru vesaiti.

Tinogona zvakare kucherechedza zvakadzama yega yega yeHTTP meseji yakatsinhaniswa, ngatione mhinduro yakaitwa newebhu server yeiyi blog pandakapinda kero http://desdelinux.net kusarudza chikumbiro chayo cheHTTP GET:

Tsanangudzo yemashoko eHTTP

Isu tinoona kuti a kodhi yemamiriro 301, inoratidza chinongedzo chakanangiswa https://blog.desdelinux.net/.

ZAP inova yakanaka kwazvo yemahara imwe nzira kune Burp Suite Kune avo vedu vari kutanga munyika ino inonakidza yekuchengetedzwa kwewebhu, isu zvirokwazvo tichapedza maawa nemaawa pamberi pechishandiso ichi tichidzidza matekiniki ekubira ewebhu, Ini ndinotakura mashoma. 😛