Skip to content

Commit

Permalink
Remove OWASP from Zed Attack Proxy references
Browse files Browse the repository at this point in the history
  • Loading branch information
bkimminich committed Jan 24, 2025
1 parent c816e2c commit e0e91c8
Show file tree
Hide file tree
Showing 4 changed files with 8 additions and 8 deletions.
8 changes: 4 additions & 4 deletions docs/modules/ROOT/pages/appendix/solutions.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -706,7 +706,7 @@ money from
. If wallet isn't empty: a. If your wallet contains funds, you cannot
start a dummy transaction to inspect the request structure because
then you would be automatically upgraded to deluxe. b. Set up a proxy
like OWASP ZAP, Fiddler aur Burp Suite. c. Click on the pay button d.
like ZAP, Fiddler aur Burp Suite. c. Click on the pay button d.
Intercept and edit the request as described above before forwarding
it.

Expand Down Expand Up @@ -1080,7 +1080,7 @@ xref:part2/security-misconfiguration.adoc#_log_in_with_the_support_teams_origina
and indicates that some support team is performing its duties from
the public Internet and possibly with VPN access.
. Guess luckily or run a brute force attack with e.g.
https://github.com/zaproxy/zap-extensions/tree/beta/src/org/zaproxy/zap/extension/bruteforce[OWASP ZAPs DirBuster plugin]
https://github.com/zaproxy/zap-extensions/tree/beta/src/org/zaproxy/zap/extension/bruteforce[ZAPs DirBuster plugin]
for a possibly exposed directory containing the log files.
. Following
xref:part2/sensitive-data-exposure.adoc#_gain_access_to_any_access_log_file_of_the_server[the hint to drill down deeper than one level],
Expand Down Expand Up @@ -2848,9 +2848,9 @@ image::appendix/inspect-premium_challenge.png[DOM inspection of the Unlock Premi
. This is a cipher text that came out of an AES-encryption using AES256
in CBC mode.
. To get the key and the IV, you should run a _Forced Directory
Browsing_ attack against the application. You can use OWASP ZAP for
Browsing_ attack against the application. You can use ZAP for
this purpose.
.. Of the word lists coming with OWASP ZAP only
.. Of the word lists coming with ZAP only
`directory-list-2.3-big.txt` and
`directory-list-lowercase-2.3-big.txt` contain the directory with
the key file.
Expand Down
2 changes: 1 addition & 1 deletion docs/modules/ROOT/pages/part3/contribution.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -200,7 +200,7 @@ and internet access to be able to pass.
If you have a web proxy configured via `HTTP_PROXY` environment
variable, the end-to-end tests https://docs.cypress.io/guides/references/proxy-configuration[will honor this setting]. This can be
useful to e.g. run the tests through tools like
https://www.zaproxy.org/[OWASP ZAP] or Burpsuite.
https://www.zaproxy.org/[ZAP] or Burpsuite.

=== Manually testing packaged distributions

Expand Down
4 changes: 2 additions & 2 deletions docs/modules/ROOT/pages/part4/trainers.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -215,13 +215,13 @@ plan your training accordingly.
|===
| Tool | Description | Effort to automate | Execution runtime | Challenges (Auto-solve?)

| OWASP ZAP _Traditional Spider_ or _Forced Browse_ with https://raw.githubusercontent.com/daviddias/node-dirbuster/master/lists/directory-list-lowercase-2.3-small.txt[small (or bigger) OWASP DirBuster list]
| ZAP _Traditional Spider_ or _Forced Browse_ with https://raw.githubusercontent.com/daviddias/node-dirbuster/master/lists/directory-list-lowercase-2.3-small.txt[small (or bigger) OWASP DirBuster list]
| Finds `/ftp` folder with many misplaced files _and_ `/promotion` (and direct `/video`) path with jingle video
| 🧠
| ⏳⏳
| Confidential Document(❌), Forgotten Developer Backup(❌), Forgotten Sales Backup(❌), Misplaced Signature File(❌), Login Support Team(❌), Video XSS(❌)

| OWASP ZAP _Forced Browse_ with https://raw.githubusercontent.com/daviddias/node-dirbuster/master/lists/directory-list-lowercase-2.3-big.txt[big OWASP DirBuster list]
| ZAP _Forced Browse_ with https://raw.githubusercontent.com/daviddias/node-dirbuster/master/lists/directory-list-lowercase-2.3-big.txt[big OWASP DirBuster list]
| Finds `/encryptionkeys` directory with `jwt.pub` _and_ `premium.key` key files
| 🧠
| ⏳⏳⏳
Expand Down
2 changes: 1 addition & 1 deletion docs/modules/ROOT/pages/part4/troubleshooting.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -191,5 +191,5 @@ which are by default disabled in Docker environments and shared
platforms like Heroku.
* You may find it easier to find vulnerabilities using a pen test tool.
We strongly recommend
https://www.zaproxy.org/[OWASP ZAP (Zed Attack Proxy)] which is open
https://www.zaproxy.org/[ZAP (Zed Attack Proxy)] which is open
source and very powerful, yet beginner friendly.

0 comments on commit e0e91c8

Please sign in to comment.