Ringkasan

OWASP ZAP (Zed Attack Proxy) merupakan salah satu tool open-source paling populer untuk:

web penetration testing
vulnerability assessment
intercepting HTTP/HTTPS traffic
fuzzing
API security testing
automated DAST scanning

Tool ini sering digunakan oleh:

penetration tester
bug bounty hunter
red team
DevSecOps engineer
web security analyst

Arsitektur Dasar ZAP

Browser
   ↓
OWASP ZAP Proxy
   ↓
Target Web Application

ZAP bekerja sebagai:

intercepting proxy
vulnerability scanner
web crawler
active attack engine

Instalasi OWASP ZAP di Kali Linux

Update Repository

sudo apt update && sudo apt upgrade -y

Install OWASP ZAP

sudo apt install zaproxy -y

Verifikasi Instalasi

zaproxy --version

Menjalankan ZAP

zaproxy

Atau:

owasp-zap

Struktur Interface ZAP

Komponen	Fungsi
Sites Tree	Mapping seluruh target website
Request Panel	Melihat request HTTP
Response Panel	Melihat response server
Alerts	Daftar vulnerability
History	Riwayat seluruh traffic
Spider	Crawling endpoint website
Fuzzer	Payload fuzzing engine

Setup Browser Proxy

Proxy Default ZAP

Host : 127.0.0.1
Port : 8080

Firefox Proxy Setup

Settings
  ↓
Network Settings
  ↓
Manual Proxy Configuration

Isi:

HTTP Proxy : 127.0.0.1
Port       : 8080

Centang:

Use this proxy server for all protocols

Menggunakan Browser Internal ZAP

Cara termudah:

Tools
  ↓
Open Browser

Browser internal sudah otomatis:

trusted
configured
connected ke proxy ZAP

HTTPS Interception Setup

Problem Umum

Saat membuka HTTPS:

SSL error
certificate warning
connection insecure

Karena browser belum mempercayai certificate ZAP.

Download Root CA ZAP

Buka:

http://zap/

Download:

OWASP ZAP Root CA certificate

Import Certificate Firefox

Settings
  ↓
Privacy & Security
  ↓
Certificates
  ↓
View Certificates
  ↓
Authorities
  ↓
Import

Centang:

Trust this CA to identify websites

Intercept HTTP Request

Aktifkan Break Mode

Klik:

Top Toolbar
  ↓
Break

Atau:

Ctrl + B

Contoh Request

GET /profile?id=1 HTTP/1.1
Host: target.local
Cookie: PHPSESSID=abcd

Manipulasi Parameter

Ubah:

GET /profile?id=2 HTTP/1.1

Kemudian:

Forward

Passive Scanning

Fungsi Passive Scan

Passive scan:

tidak menyerang target
hanya menganalisa traffic

Deteksi:

insecure headers
cookie issue
information disclosure
CSP weakness

Cara Menggunakan

Cukup browse website melalui proxy ZAP.

Hasil otomatis muncul di:

Alerts Tab

Spidering Website

Traditional Spider

Klik kanan target:

Attack
  ↓
Spider

Fungsi:

crawl endpoint
discover page
discover parameter
mapping attack surface

AJAX Spider

Untuk aplikasi modern:

React
Vue
Angular
SPA

Gunakan:

Attack
  ↓
AJAX Spider

Karena endpoint banyak dibuat via JavaScript.

Active Scan

Fungsi

Active scan:

mengirim payload attack nyata
mencoba exploit otomatis

Deteksi:

XSS
SQLi
LFI
RCE
SSRF
command injection

Menjalankan Active Scan

Klik kanan target:

Attack
  ↓
Active Scan

Tingkatan Severity

Severity	Arti
High	Critical vulnerability
Medium	Potential exploitation
Low	Weak configuration
Informational	Non-critical information

Fuzzing Parameter

Menjalankan Fuzzer

Pilih parameter:

Right Click
  ↓
Fuzz

Contoh Payload XSS

<script>alert(1)</script>
"><svg/onload=alert(1)>

Contoh Payload SQL Injection

'
' OR '1'='1
admin'--

Payload LFI

../../../../etc/passwd

Authentication Handling

Gunakan:

browser internal ZAP
login manual
session akan otomatis tersimpan

Context Configuration

Right Click Target
  ↓
Include in Context

Authentication Method

Context
  ↓
Authentication

Support:

form auth
JSON auth
bearer token
script-based auth

API Security Testing

Import Swagger/OpenAPI

File
  ↓
Import
  ↓
OpenAPI Definition

Import Postman Collection

File
  ↓
Import
  ↓
Postman Collection

Attack Modes

Mode	Fungsi
Safe	Tidak melakukan attack aktif
Protected	Attack hanya pada scope tertentu
Standard	Default normal mode
Attack	Auto attack seluruh request

Automation via CLI

Quick Scan

zap-baseline.py -t https://target.com

Full Active Scan

zap-full-scan.py -t https://target.com

Output Report

zap-full-scan.py -t https://target.com -r report.html

Docker Usage

Pull Image

docker pull ghcr.io/zaproxy/zaproxy:stable

Run Container

docker run -u zap -p 8080:8080 -i ghcr.io/zaproxy/zaproxy:stable zap.sh -daemon -host 0.0.0.0 -port 8080

Automation API

API Endpoint

http://127.0.0.1:8080

Example API Scan

curl "http://127.0.0.1:8080/JSON/ascan/action/scan/?url=https://target.com"

Reporting

Generate HTML Report

Report
  ↓
Generate Report

Supported Formats

HTML
JSON
XML
Markdown

Workflow Pentesting Menggunakan ZAP

[1] Setup Proxy
[2] Import SSL Certificate
[3] Browse Target
[4] Passive Scan
[5] Spider / AJAX Spider
[6] Active Scan
[7] Manual Testing
[8] Fuzzing
[9] API Testing
[10] Generate Report

Vulnerability Category Umum

[+] Cross-Site Scripting (XSS)
[+] SQL Injection
[+] Local File Inclusion
[+] Remote Code Execution
[+] Directory Traversal
[+] SSRF
[+] Weak Headers
[+] Sensitive Information Disclosure
[+] Authentication Weakness

Integrasi DevSecOps

OWASP ZAP sering digunakan untuk:

CI/CD security scanning
GitHub Actions
GitLab CI
Jenkins pipeline
automated DAST
compliance scanning

Best Practice

[+] Gunakan Safe Mode saat reconnaissance
[+] Jangan active scan tanpa izin
[+] Scope target dengan benar
[+] Simpan session project
[+] Gunakan AJAX Spider untuk SPA
[+] Pisahkan authenticated & unauthenticated scan
[+] Review false positives

Lab Aman untuk Belajar

DVWA

Damn Vulnerable Web Application

OWASP Juice Shop

Modern intentionally vulnerable application

Metasploitable

Practice vulnerable VM

Risiko Penggunaan

Active scan dapat:

menyebabkan service crash
trigger WAF/IDS
generate log attack
memicu rate limiting
dianggap unauthorized attack

Gunakan hanya:

lab sendiri
authorized environment
bug bounty scope valid

Status Analisis Tool

[+] Platform            : Kali Linux
[+] Tool Category       : Web Application Security
[+] Usage Type          : Proxy + DAST Scanner
[+] Skill Requirement   : Beginner → Advanced
[+] Automation Support  : Yes
[+] API Support         : Yes
[+] DevSecOps Ready     : Yes

Kesimpulan

OWASP ZAP merupakan salah satu tool paling kuat untuk web application penetration testing di ekosistem open-source.

Kombinasi:

intercepting proxy
automated scanner
fuzzing engine
API testing
scripting automation

menjadikannya sangat efektif untuk:

bug bounty
pentest internal
DevSecOps automation
security assessment modern web application

OWASP ZAP Complete Usage Guide on Kali Linux for Web Application Penetration Testing