ZAP Tool is a security tool which is an easy-to-use integrated penetration testing tool for finding vulnerabilities in web applications/Web apps.

ZAP provides automated scanners as well as a set of tools that allow you to find security vulnerabilities manually.

How It Works-

You need to configure the proxy with your browser  and set your Local host manually.

It is one of most common vulnerability under OWASP project and the top second vulnerability is Broken Authentication and session management. Here I will tell you how it works in ZAP.

Authentication, Session Management and User Management

 
Authentications:- ZAP can handles 4 types of authentication.

1. Manual Authentication
2. Form Based Authentication
3. Script Based Authentication
4. HTTP Authentication

These Authentication methods can be used for website/webapps.we need to setup the username and password & regex configuration,when using the Form Based Authentication method.

Session Management-ZAP handles two types of session management, No configuration is needed for this authentication method.

1.Cookies based session management- Session is being tracked through cookies.
2.HTTP Session Management- This session is managed by http header authorization.

User Management-User management mainly used for authentication method and Authentication method defines how the process is done, so the necessary credentials are dependent on the users, so need to add the users in ZAP.

Steps:-
1. Set Proxy with Local Browser
2. Then Right click on the site and include a web app/site in context as an option “Include in context”
3. Find out the post request under the context at the left side tree.
4. Select the post request and Include in context as Default.

Context Includes:-

1) Authentication,

2) Session Management,

3) User Management

 Authentication-

* Select authentication Form Based Form

* Target URLs' and Username and Password are shown prefilled once you include the context of post request as it shown as like below:-
Login Request POST Data: username={%username%}&password={%password%}&proceed=login
* Set Parameters as a Username and Password.* Include regex pattern for logged in or logged out response.
* You need to find the pattern in response view at the right side.
* Find out the log out link and select it and Flag as context and select logged in indicator.
* Its set the regex log-out pattern automatically  in “Form Based Authentication”

5. Context- Session Management
* Set Cookies based session management

6. Context- User Management
* You need to add 2 users here, one is existing users while recorded the script and another is invalid user which you need to be added. For example test@gmail.com
* Check the Forced User Mode should be enable before attacking it. (Forced User Mode placed at top icon)
We can select the get request and applied attack for spider and select test user/invalid user and attack on site.
If invalid user is shown in the response, it means user able login through invalid user otherwise scenario is passing.