### If you are an Web Application Developer, then security vulnerabilities will be in your top of list to do, before releasing the Web Application to public. And OWASP (Open Web Application Security Project) helps a lot to improve your application security by providing a tool called Zed Attack Proxy (ZAP). 

ZAP from OWASP  is an open source free security tool which can help you to find security vulnerabilities in your web applications. You can use it during your development and testing phase or after development completion as well. Its also used for penetration testing or manual security testing. 

The project has got its own Wiki : https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project

You can download the ZAP tool from there, and then go through the [Getting Started Guide](https://github.com/zaproxy/zaproxy/releases/download/2.6.0/ZAPGettingStartedGuide-2.6.pdf) or the [User Guide](https://github.com/zaproxy/zap-core-help/wiki).

After downloading and installing it , you can start using it for penetration testing for your application. For the purpose of demonstration, I will be trying to attack Steemit.com to see what it gets to us. 

![image.png](https://res.cloudinary.com/hpiynhbhq/image/upload/v1514458523/jbthfr4nvzncdano2tva.png)

As you see in the above screen print, this is the page that opens up after you start the application. And you can put the URL and then click on Attack button. I hope Steemit.com does not mind me doing this as I am doing it for demonstration of  a good cause. Once you click that button, it will start sending requests to the site and analyze the vulnerabilities. 

So after few minutes, it will present you with all the list of vulnerabilities . 

![image.png](https://res.cloudinary.com/hpiynhbhq/image/upload/v1514458828/vqarunsk83kblfwchbfv.png)

As you can see in the above screen print, its reporting 4 different alerts and clicking on each of them will show you the potential implication of that. Let's go ahead and click few of the alerts that is reported in the Cookie without Secure flag : 

![image.png](https://res.cloudinary.com/hpiynhbhq/image/upload/v1514459837/oigqyhy5yexje8zp6pok.png)

As you can see, its reporting that a cookie named AWSALB is being set without the secure flag and it shows the value as well. 

If we click the second one then we see another Cookie named stm1 is also being set similarly. 
![image.png](https://res.cloudinary.com/hpiynhbhq/image/upload/v1514459993/ngzzqlzm0hafp7z0pnqo.png)

And then it also shows up the potential implications. For example, if a Cookie is set without Secure Flag, then it can be  accessed via unencrypted connections. So as an application developer you will need to ensure that the secure flag is set for cookies as they contain sensitive information. Once you fix that, you can scan it again, and see it does not show up again. 

You can set the ZAP as proxy between your browser and your application, thus setting it as man-in-the-middle proxy. Then you can capture the request and response each time and analyze what is happening in between. 

ZAP has lot of potential uses, however as part of this tutorial I wanted to spread the awareness about such a wonderful open source security tool. And also you can participate in their code contribution and translations. Hopefully they can also help you earn in this utopian platform. 

Let me know, if you have any questions or need any help on this further. 


<br /><hr/><em>Posted on <a href="https://utopian.io/utopian-io/@sanjeevm/owasp-zed-attack-proxy-an-open-source-security-tool-to-find-security-vulnerabilities">Utopian.io -  Rewarding Open Source Contributors</a></em><hr/>