Inquiry on ZAP Features

[Sumitra Sahoo]

Hello Team,

Can we do the following tastings using ZAP?

1.Session Management

2.Access Control

3.Memory Management

4.Database Security

5.Database  System Configuration

6. Data Protection

7.Source code scanning for checking personal data

Thank you 

[psiinon]

Hiya,

ZAP is a tool for testing web aplications via web based protocols such as HTTP(S).

You can use ZAP to test a web application's session management and access control.

It can also be used to find database issues which give rise to SQL injection.

However it will not directly test databases for security issues or test your application's memory management.

ZAP will identify some PII Disclosure issues.

ZAP is not a static source code analysis tool and so does not analyse source code, although it can find some issues in the JavaScript files that are part of a web application.

Cheers,

Simon

--
You received this message because you are subscribed to the Google Groups "ZAP Developer Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to zaproxy-devel...@googlegroups.com.
To view this discussion on the web, visit https://groups.google.com/d/msgid/zaproxy-develop/6cf3eb92-e874-450e-9b36-ee9503d631b5n%40googlegroups.com.

--

ZAP Project leader

[Sumitra Sahoo]

Thanks for replying. How can I do Session Management and Access Control testing using ZAP ?

Thanks

[Nguyễn Ngọc Tiến]

i am blind and using jaws 2022, and NVDA, i cant access the features
of owasp zap, accessibility features are very poor, and screen readers
respond quite slowly, so how are you guys using owasp zap? Is it
possible to use its full features? please share with me.

2023-08-10 19:59 GMT+07:00, Sumitra Sahoo <sahoosum...@gmail.com>:
> Thanks for replying. How can I do Session Management and Access Control
> testing using ZAP ?
>
>
> Thanks
>
> On Thursday, August 10, 2023 at 5:57:27 PM UTC+5:30 psiinon wrote:
>
>> Hiya,
>>
>> ZAP is a tool for testing web aplications via web based protocols such as
>>
>> HTTP(S).
>> You can use ZAP to test a web application's session management and access
>>
>> control.
>> It can also be used to find database issues which give rise to SQL
>> injection.
>> However it will not directly test databases for security issues or test
>> your application's memory management.
>> ZAP will identify some PII Disclosure

>> <https://www.zaproxy.org/docs/alerts/10062/> issues.

>> ZAP is not a static source code analysis tool and so does not analyse
>> source code, although it can find some issues in the JavaScript files that
>>
>> are part of a web application.
>>
>> Cheers,
>>
>> Simon
>>
>> On Thu, Aug 10, 2023 at 2:16 PM Sumitra Sahoo <sahoosum...@gmail.com>
>> wrote:
>>
>>> Hello Team,
>>>
>>> Can we do the following tastings using ZAP?
>>>
>>> 1.Session Management
>>> 2.Access Control
>>> 3.Memory Management
>>> 4.Database Security
>>> 5.Database System Configuration
>>> 6. Data Protection
>>> 7.Source code scanning for checking personal data
>>>
>>>
>>> Thank you
>>>
>>>
>>> --
>>> You received this message because you are subscribed to the Google Groups
>>>
>>> "ZAP Developer Group" group.
>>> To unsubscribe from this group and stop receiving emails from it, send an
>>>
>>> email to zaproxy-devel...@googlegroups.com.
>>> To view this discussion on the web, visit
>>> https://groups.google.com/d/msgid/zaproxy-develop/6cf3eb92-e874-450e-9b36-ee9503d631b5n%40googlegroups.com
>>>

>>> <https://groups.google.com/d/msgid/zaproxy-develop/6cf3eb92-e874-450e-9b36-ee9503d631b5n%40googlegroups.com?utm_medium=email&utm_source=footer>
>>> .
>>>
>>
>>
>> --
>> ZAP <https://www.zaproxy.org/> Project leader

>>
>
> --
> You received this message because you are subscribed to the Google Groups
> "ZAP Developer Group" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to zaproxy-devel...@googlegroups.com.
> To view this discussion on the web, visit

> https://groups.google.com/d/msgid/zaproxy-develop/4889b43d-cf35-4ea2-9a4c-7e4a6a8b8064n%40googlegroups.com.
>

[psiinon]

We do have an Access Control Testing add-on: https://www.zaproxy.org/docs/desktop/addons/access-control-testing/

For session management you will need to do manual testing using ZAP.

For details of how you can do that see the OWASP Web Security Testing Guide: https://owasp.org/www-project-web-security-testing-guide/

Cheers,

Simon

[psiinon]

Hiya,

Its best to start a new conversation for new topics, but I'm guessing the Google Groups UI isnt that accessible either?

We do have an open issue for using ZAP with a screen reader: https://github.com/zaproxy/zaproxy/issues/4567

We definitely want to make ZAP as accessible as possible, but none of the core team has any experince in developing accessible UIs, as far as I am aware :/

What would really help would be a prioritised list of changes that we need to make - we can then start working through them, at each stage confirming that any changes we make do actually help.

Many thanks,

Simon