►
Description
ZAP stands for Zed Attack Proxy, and it's the world's most widely used web application scanner. Watch the full video to learn from Simon and Joseph about the role security plays in open source.
0:00 - Introductions
1:27 - What is Zap?
7:48 - Static analysis vs. Dynamic analysis
10:37 - How has the state of security changed over the years?
15:10 - Demo
21:38 - Dark Mode theme
23:01 - Common mistakes in securing web apps
30:08 - The origin of the name
37:13 - How to contribute
49:21 - Fun chit chat
Join @blackgirlbytes live for Open Source Fridays at https://www.meetup.com/github/.
Thanks!
Connect with us.
Facebook: http://fb.com/github
Twitter: http://twitter.com/github
LinkedIn: http://linkedin.com/company/github
About GitHub
GitHub is the best place to share code with friends, co-workers, classmates, and complete strangers. Millions of people use GitHub to build amazing things together. For more info, go to http://github.com
Chapters
A
B
Thank
you
very
much
and
thank
you
for
inviting
me
my
name's
Simon
Bennett
I
release
zap
in
2010
and
I'm.
One
of
the
core
team
I've
got
a
core
team
who
maintain
it
now
and
so
that's
what
I
do
but
I
actually
work
full
time
for
jit
who
bring
together
a
whole
load
of
open
source
security
tools
and
building
a
platform
on
top
of
that.
But
they,
let
me
work
on
zap,
full
time.
A
B
Sure
so
zap
is
a
tool
for
finding
vulnerabilities
and
web
applications,
and
it's
it's
a
bit
different
from.
If
you're
aware
of
network
scanners,
which
kind
of
look
for
known
vulnerabilities,
a
case
where
you
know
the
traditional
we
know,
you're
running,
say
a
WordPress
site
and
you've
got
this
WordPress
plugin.
Therefore
we
know
it's
vulnerable
to
this
particular
vulnerability.
So
that's
different.
It
looks
for
new
and
interesting
vulnerabilities.
It
looks
for
custom
vulnerabilities,
so
it
can
be
an
app
that
no
one's
seen
before,
but
Zack
will
still
attack
it.
A
A
Tell
us
where
you're
calling
in
from
and
feel
free
to
ask
questions
as
we
go,
because
if
we
definitely
want
to
interact
with
with
the
audience-
and
we
don't
want
to
just
be
talking
to
ourselves
all
right,
I
wanted
to
I,
don't
know
if
it's
too
early,
but
we
usually
start
off
with
a
little
bit
of
a
demo.
And
then
we
go
into
asking
you
a
few
more
questions.
So
are
you
ready
for
for
the
demo.
A
B
Looking
good
great
so
zap
I
mean
it
starts
off
as
a
desktop
tool.
So
it's
got
this
desktop
interface,
but
actually
most
people
use
it
in
automated
way.
Completely
automated,
but
obviously
that's
hard
to
demo.
So
I'll
just
show
you
the
desktop
to
start
with
and
it
might
look
like
there's
a
lot
going
on,
but
there's
actually
loads
more.
So
that
is
a
tool
with
lots
of
depth.
We'll
try
and
make
it
easy
to
have
some
kind
of
simple
things.
We've
got
an
automated
scan,
but
what
I'll
do
is
I'll.
B
Do
a
manual
explore
and
what
you
can
do
here
is.
You
can
actually
choose
to
basically
say
what
your
your
target
application
in
is
and
then
you
can
launch
a
browser
to
explore
it.
So
this
is
a
very,
very
venerable
deliberately
vulnerable
application
I
quoted
years
ago,
and
what
you
can
do
is
you
can
just
kind
of
explore
it
and
you
know
just
just
do:
do
your
normal
testing
on
it.
B
B
A
A
B
A
B
B
Zap
is
different
because
it
is
completely
free
in
token
source.
So
you
know,
if
you're
not
interested
in
that,
then
you
know
that's
a
that's
a
different
thing,
but
I
think
it's
very
important
to
have
a
tool
like
this
app
that
is
actually
completely
free
and
anyone
could
you
know,
and
anyone
can
contribute
to
so
zap
is
very
much
a
community
project.
I
started
it
because
I
wanted
to
learn
about
security
and
I
was
a
developer.
That's
my
background.
I
wanted
to
learn
about
security.
B
I
wanted
to
join
a
a
community-based
security
tool,
a
project
and
it
didn't
exist.
There's
nothing
like
this
around
so
I
started
sap
as
a
way
to
learn
about
security
and
to
create
the
community.
I
was
looking
for.
So
if
you
want
to
get
involved
in
Securities,
you
can
contribute
to
zap.
You
know:
we've
had
loads
of
students,
we've
had
security
people
that
developers
it's
a
way
of
learning,
and
so
you
know,
if
you're
a
security,
professional
I
would
expect
you
to
have
a
burp
Pro
license.
B
But
you
shouldn't
know
the
best
tools
out
there
and
zap
is
really
good
for
certain
things.
So
you
should
notebook
and
zap
and
I'd
say
zap
is
better
than
burp.
In
some
things
like
automation,
it's
one
of
our
strengths.
Scripting
is
another
one.
With
our
insane
scripting
support,
you
can
script
pretty
much
anything
you
like,
and
you
know,
one
of
the
things
is
because
zap's
open
source
either
source
code
available,
but
also
the
data
belongs
to
you.
So
we
make
everything
available.
B
So
you
can
write
scripts,
which
basically
change
how
zap
works
on
the
Fly
and
you
have
access
to
all
the
internals.
You
can
call
any
of
the
zap
functions.
Everything's
available
to
you,
so
zap
is
way
more
customizable
and
the
automation
I
mean
zap
is:
is
the
world's
most
popular
web
application
Scanner,
partly
because
it's
free,
but
also
because
it's
so
good
automating.
C
B
I
think
that's
actually
a
really
good
question
and
I
think
the
important
thing
is
there
used
to
be
this
kind
of
static
versus
an
Dynamic
argument
and
it's
completely
wrong.
There
is.
They
are
different
ways
of
approaching
the
same
thing.
So
if
you
want
to
completely
understand
a
running
application,
you
need
to
have
static
analysis
because
that
analysis
source
code
unique
Dynamic
analysis,
because
that
attacks
the
application
the
way
an
attacker.
Would
you
need
source
code
analysis
to
work
out
what
your
dependencies
are?
B
You
need
to
understand
the
configuration,
so
you
know
all
the
cloud
stuff
as
well.
You
know
how
it's
deployed
so
there's
loads
of
things
you
have
to
understand,
and
no
one
tool
will
tell
you
that.
So
so,
if
you,
if
you
start
a
brand
new
project,
you
get
static
analysis
in
straight
away,
because
that
will
tell
you
as
soon
you
start
writing
code.
It'll
point
things
out:
you
can
fix
them
if
you've
got
a
big
existing
project
and
you
throw
static
analysis,
you'll
get
tons
of
alerts
coming
up
and
you
go.
B
What
do
we
do?
You
know
we
added
a
static
analysis
to
that
years
ago
and
we
had
so
many
issues
and
very
few
of
them
were
actually
serious,
but
it
was
overwhelming,
but
you
know
a
lot
of
us
working
security.
Obviously
we
work
in
security.
We
understand
these
things
and
we
worked
our
way
through
them
and
now
you
know,
we've
all
of
our
PR's
get
static
analysis
run
on
them.
B
B
So
you
know
that
is
what
people
will
be
doing
right
now.
The
attackers
will
be
attacking
applications
using
the
same
techniques
as
the
adapter
tools
like
zap.
So
that's
really
important,
but
things
like
you
know
your
software
compensation
analysis
is
key
as
well,
because
you've
got
to
keep
your
dependencies
up
to
date.
B
So
you
need
all
of
these
things.
You
shouldn't
be
going.
I
will
only
do
one
of
these
types
of
tools,
but
it
is
getting
started.
You
need
to
start
somewhere,
so
new
project,
I'd,
say
SAS.
First,
then,
when
you've
got
something
running,
you've
got
you
bring
in
dust,
get
SCA
in
to
start
with
as
well
existing
product
start
with
dust.
You
know
start
with
dust,
bring
SCA
and
bring
fast
in,
but
expect
to
find
loads
of
loads
of
things.
That
reported
to.
C
You
I
also
found
really
interesting
the
fact
the
fact
that
you
mentioned
that
when
you
started
this
up,
what
made
you
start
in
the
beginning
was
the
fact
that
there
was
no
other
community
out
there
for
you
to
join
and
do
this
open
source
security
Tool.
But
you
didn't
mention
when
how
far
the
ago
was
that
and
how
things
have
changed
over
the
years?
What's
the
state
of
today
so.
B
That
was
in
2010,
I
actually
started,
so
I
thought
an
abandoned,
secure,
a
security
project
called
Paris
proxy
and
I
got
involved
because
in
2009
I
developed
a
web
application
that
was
pen
tested
and
found
loads
of
vulnerabilities,
which
I've
never
heard
of
and
it
you
know,
I
was
a
developer,
but
I've
had
no
security,
training
zero.
So.
C
B
Not
surprising
a
lot
of
vulnerabilities,
so
I
wanted
to
learn
about
things.
I
learned
best.
By
doing
so,
I
wasn't
planning
on
moving
into
security.
I
just
wanted
to
make
my
own
applications
more
secure,
so
I
thought
I'd
find
an
open
source
security
project.
I
will
run
it
against
my
applications
every
night,
so
I
don't
get
embarrassed
by
the
pen
testers,
but
I'd
use
it
as
a
way
of
learning
about
security
and
I
thought.
You
know,
I
want
to
get
involved
in
open
source.
B
But
you
think
how
things
have
changed
and
I
think
things
have
changed
significantly
so
in
general,
I
think
they're
better.
To
be
honest,
I
don't
want
to
be
all
doom
and
gloom
and
I
think
there's
a
whole
range
of
reasons.
One
is
better
education,
so
developers
know
more
about
security.
These
days,
they've
had
some
training,
often
and
organizations
like
OAS
have
really
helped
I
think
better
Frameworks.
B
C
B
B
So
I
think
that
generally
helps
definitely
better
open,
open
source
security
tools
like
that,
but
also
there's
a
whole
load
of
particularly
the
SAS
tools
and
Commercial
tools
that
are
free
to
open
source
developers,
which
we
use
in
zap
as
well.
So
the
availability
of
these
tools
really
helps
and
running
security
tests
in
cicd,
so
I'm
a
big
fan
of
GitHub
actions.
We've
got
zap
GitHub
actions,
all
the
zap
PRS
get
you
know
scanning
as
part
of
the
pull
requests.
This
is
really
important.
B
You
know
making
it
easier
to
make
sure
you're
secure
as
you're
developing
the
code
and
finally
I
think
bad
publicity.
All
the
new
stories
about,
and
corporations
getting
hacked.
You
know
turning
up
on
national
TV
that
actually
helps
security,
awareness
and
means.
You
know
people
are
developers
aware
of
it
and
I
will
just
so
this
he
wants
to
join
in
she
likes.
A
B
Yeah
I
mean
different
people
work
in
different
ways.
You
know
and
they
learn
better
in
different
ways.
Some
people,
you
know,
might
learn
well
by
reading
books.
Other
people
buy,
you
know
watching
YouTube
videos
or
reading
documents.
I
learn
best
by
doing
I've
got
to
hack
stuff.
That's
absolutely
key
for
me.
So
that's
that's.
What
I
do.
B
B
You
can
launch
your
browser
pointing
up
to
your
target
application,
which
I
can
make
a
bit
bigger,
and
you
can
just
navigate
around
your
application
and
you
can
kind
of
do
whatever
you
normally
do
and
what
you'll
see
is
all
the
requests
and
responses
are
proxy
through
zap
and
you
can
actually
see
the
request
and
the
response
now.
One
of
the
other
things
you'll
see
down
here
is
we've
got
a
load
of
alerts,
and
these
are.
This
is
zap
telling
you
stuff,
so
we've
actually
got
some.
B
You
know.
Zap
is
actually
telling
us
that
there
are
problems
without
doing
anything
particular
because
zap
doesn't
do
things
unless
you
tell
it
to,
but
one
of
the
things
it
can
do
is
passively
analyzing
the
question
responses
and
it
can
go
here
and
it
can
see
this
particular
response.
You
can
see,
there's
a
form
and
there's
no
anti-cross
cycle,
there's
forgery,
token.
It
can
tell
that
so
it's
already
raised
an
alert
so,
and
it's
raised
four
alerts
in
fact,
so
we
can
tell
that
there
are
problems
without
that
attacking
the
application.
B
So
you
know
something
you
can
use
that
on
production
applications.
If
you
you
know,
don't
actually
do
attacking
and
it'll
still
tell
the
useful
things
we
can
see
that
you
know.
There's
the
cross.
The
content
security
policy
header
is
not
set.
We
can
see,
there's
cross
domain
configuration
which
can
see
this
cookie
set
with
no
hdb
only
Flags.
So
there's
lots
of
things
it's
already
telling
us,
but
there's
lots
more
zap
can
do
so.
One
thing
we
can
do
we
can
do.
B
We
can
run
the
spider,
so
we
there's
different
ways
of
exploring
an
application.
Obviously
it's
great.
If
you
can
do
it
manually,
that's
most
applications.
Are
you
know,
they're
designed
for
humans
to
use,
so
usually
humans
are
quite
good
at
exploring
them,
but
that
takes
time
and
it's
much
harder
to
automate.
We
have
spiders
and
what
you
can
do
is
if
you
right
click,
you'll,
see
loads
of
different
options.
We
have
a
traditional
spider
that
just
crawls
the
application.
B
B
So
and
you
can
do
fun
things
as
well.
So
you
see
here,
we've
got
this
very
simple
control
and
I
there's
a
limit
to
what
I
can
put
in
because
it's
controlled
here
and
we
can't
actually
go
above
12
and
we
can't
go
below
zero.
But
if
we
actually,
we
can
put
a
breakpoint
on.
We
can
submit
that
and
we
can
actually
see
the
request
here
and
we
can
change
it.
B
So
we
can
change
it,
make
it
much
bigger
and
we
can
submit
that
and
then
you'll
see,
we've
added
a
lot
more
than
the
12
we're
allowed
or
we
can
actually
go
in
and
we
can
submit
it
and
we
can
change
it
to
minus
a
large
amount,
and
then
we
will
see
that
the
shop
actually
owes
us
money.
So
we
can
do
all
sorts
of
fun
things.
B
B
B
Yeah
and
that's
that's
one
thing
that
you
know:
we've
seen
huge
changes
in
the
last
12
years
and
I
mean
I.
Think
one
thing
is:
Zappos
has
changed
quite
a
lot
over
the
years
as
well,
so
I
think
it's
in
2012
we
introduced
the
Ajax
spider.
So
what
we
found
was
the
traditional
spider.
It
did
the
standard
crawling
it
just
you
know,
look
to
request
responses,
found
URLs
and
did
the
standard
crawling.
This
doesn't
work
with
modern
web
apps.
B
If
you
look
at
the
the
source
code
in
your
browser
right
click
view,
Source
you'll
see
a
load
of
libraries
and
nothing
else.
You
have
to
actually
look
at
the
Dom
you
have
so
you
have
to
have
a
real
browser
there.
So
the
Ajax
spider
works
by
launching
browsers
and
clicks
on
things
it's
much
slower
than
the
traditional
spider,
but
it's
what
you've
got
to
do
so.
B
The
Ajax
spider
2012
one
of
the
First
Security
project
approach
to
support
that
websockets
in
the
same
year,
and
we
were
pretty
much
the
first
security
tools
to
support
websockets
and
probably
have
the
best
websocket
support.
Still
to
this
day,
API
scanning,
we
started
with
soap
in
2014,
open,
API,
Swagger
2017.
We
supported
graphql
in
2020
and
then
things
like
out-of-band
testing
last
year,
but
we
still
know
that
modern
web
apps
are
still
a
bit
challenging.
They
are
hard.
B
So
that
is
a
focus
for
me
myself
and
I'm
working
on
something
right
now.
I've
got
some
fun
things
to
show,
but
it's
not
quite
ready
yet
so
it's
going
to
be
releasing
something
soon
and
it
won't
solve
everything.
But
it's
a
it's
a
start
and
it's
something
again.
We
want
people
to
get
involved
in.
So
it's
something
we're.
Definitely
focusing
on
and
watch
this
space
or
even
better
get
in
touch
and
get
involved.
A
B
B
B
B
Yeah,
that's
tricky
so
on
the
phone
just
go
in
the
background
right,
one
thing
is
I.
Think
I
mean
we
don't
get
a
lot
of
direct
feedback.
People
use
that,
but
then
tell
us
much
about
it,
and
we
do
know
that
we
do
get
some
Telemetry.
So
I
had
a
look
at
that.
I
mean
I
know
that
we
have
there's
lots
of
robots
projects.
One
of
the
I
was
top
10,
which
is
very
famous
and
the
top
one.
B
B
But
I
had
a
look
at
the
Telemetry
and
the
most
significant
vulnerability,
so
I
think
we
find
are
still
injection
vulnerabilities,
okay
and,
to
my
surprise,
the
most
the
most
one
we
find
now
is
Dom
xss
I
was
expecting
traditional,
xss
or
or
SQL
engine
or
yeah
injection
to
be
up.
There
is
actually
Dom
xss
and
last
month
we
found
nearly
half
a
million
domx
SS
vulnerabilities.
B
Now
how
many
of
those
were
in
delivery?
Phone
up?
Applications-
I,
don't
know,
but
you
know
we
just
have
Telemetry
gives
us
basic
stats.
It
doesn't
tell
us
what
those
stats
really
mean,
but
yeah
of
the
injection
vulnerability,
as
far
as
we
can
tell,
which
is
which
is
interesting,
but
the
other
one
I
think
things
like
logical
errors,
I
think
and
I.
B
Think
oh,
what's
the
top
10
cause
them
insecure
design,
and
this
is
the
these-
are
the
ones
that
it
seems
like
the
the
budget,
one
where
you
were,
you
could
put
a
negative
amount
in
they're,
difficult
to
automate
tools
to
find
them,
because
you
don't
have
to
Summer
have
some
understanding
of
the
application,
and
these
are.
These
are
one
of
the
reasons
why
we're
not
going
to
get
rid
of
pen
testers.
B
B
That's
where
the
human
mind
comes
into
its
own
and
that's
where
the
pen
tests
are
so
important,
so
you
know
I
think
those
ones
are.
Those
are
the
fun
ones
really.
You
know
when
you're,
when
you're
looking
at
how
can
I
understand
this
application?
How
can
I
get
under
its
skin?
How
can
I
abuse
its
functionality?
You.
C
Love
how
our
audience
absolutely
loves.
Zap,
for
example,
there's
another
comments
about
one
more
thing:
I
like
about
this
app,
it's
docs
based
on
the
common.
So
that's
another,
really
good
piece
of
feedback
for
Simon
today,
I
think
Simon.
Based
on
what
you
said.
My
next
question,
based
on
the
high
number
of
Dom
attacks
you
mentioned,
is
how
can,
if
you
could,
what
you
can
do
to
make
a
security
higher
priority
for
Developers.
B
Right
I
mean
one
thing
is
awareness,
you
know
it's,
so
it's
it's
up
to
us,
Security
Professionals,
to
keep
press.
You
know
explaining
how
important
it
is.
I
think
it's!
You
know.
If
you're
talking
commercial
environments,
it's
a
management
problem,
it
really
is
because
developers
do
yeah.
We
do
what
we're
told
you
know
if
Manchester
is
saying
get
this
stuff
done
as
quickly
as
possible.
Then
that's
what
will
happen
if
you
just
got
if
you've
got
functionality.
You
know
functionality
is
more
important
security.
If.
B
It
doesn't
do
if
the
application
doesn't
do
anything,
it's
useless.
You
know
it
really
is
so
you
know
all
this
thing
is
security.
Is
the
most
important
thing?
I,
don't
agree.
You
know
functionality
has
to
come
first,
but
we
need
this
functionality
to
be
secure,
and
for
that
we
need
to
have
time
as
developers.
We
need
to
have
time
to
make
sure
that
you
know
an
application
is
secure.
They're
maintainable,
all
these
important
things
they
scale.
B
So
management
have
to
understand
that
to
do
to
do
software
properly
takes
longer,
but
it
means
it's.
You
know
better
in
the
end,
you
don't
have
to
go
back
and
actually
fix
things.
You
know
fix
all
the
problems,
all
the
vulnerabilities,
all
the
bugs
later
on
so
yeah
just
have
more
time
in
upfront
doing
things
like
security,
but
you
know
it's
you've.
A
A
I
love
that
you
pointed
that
out
because
in
all
my
my
few
years,
working
as
a
developer,
I
hear
people
saying
like
it's
very
important
to
do
testing
it's
very
important
to
do
security
but
I'm
like
I.
Don't
have
time
like
we
have
this
short
little
Sprint
for
me
to
do
a
whole
bunch
and
then,
when
I'm,
like
oh
I'm,
still
like
adding
some
tests.
They're
like
hurry
this
up
so
I
love
that
you
pointed
that
out.
It's
it's
coming
from
the
the
top
down
it.
B
C
B
A
wasp
os.org
there's
a
huge
amount
of
resources.
Everything
free
is
free,
everything's
open
source,
but
you
know
if
you're
a
developer
and
you
like
getting
stuck
in
then
well
contribute
to
zap
or
contribute
to
one
of
the
other
Roblox
projects.
I
mean
it's
a
bit
of
a
different
organization
in
that
anyone
can
join
it's
not
a
one
where
your
organization's
got
to
pay
to
get
involved,
so
individuals
can
get
involved
like
I
did
and
you
can
get
involved
in
any
project.
B
B
No,
there's,
there's
so
much
more
to
open
source
than
just
programming.
So
you
know:
there's
testing,
there's
documentation,
there's
support,
there's
a
loads
of
things
you
can
get
involved
with
or
you
can
learn
programming,
one
of
the
exact
core
team,
Records
security
guy
and
he
learned
programming
programming
on
tap.
So
you
know
there's
loads
of
things
you
can
do.
But
if
you
want
to
learn
by
doing
then
loads
of
os
projects,
you
know
just
people
on
the
appeals
to
you
most
hopefully.
Is
that,
but
otherwise
go
for
what
you
want.
A
That's
awesome
that
he
learned
it
through
like
learn
programming
through
his
app.
That's
amazing
what
your
project
is
enabling
and
empowering
I'm
gonna
ask
a
question
that
we
started
to
talk
about
before
we
went
live
and
it
was
like
about
the
name
sap.
Like
you
told
us,
there
was
a
background.
That's
the
first
time
I
ever
heard
of
a
acronym,
so
yeah
tell
us
more
about
how
you
came
up
with
the
name
and
and
US
learning
about
the
fact
that
it
stands
for
said,
attack
proxy
I,
hope,
I.
B
Got
that
right,
yep,
so
I
naming
is
hard.
It's
really
hard,
I,
I'm,
no
good
at
coming
up
with
names,
so
I
I
thought
this
whole
project
called
Paris
and
I
wanted
to
give
a
very
different
name,
because
I
actually
wanted
to
be
the
security
tools
for
developers,
and
that
was
our
tagline
to
start
with
really
removed
that
off
to
be
security.
People
complaint
so
I
want
a
different
name,
but
what's
called
it
I'm
a
developer,
I've
always
written
scripts.
You
know
if
you
want
to
automate.
B
If
you've
got
to
do
something
once
you
don't
want,
if
it,
if
you've
got
to
do
it
two
or
three
times
underwrite
a
script
to
do
it,
you
know
that's
what
I
do
if
I
think
the
script
is
going
to
be
useful
in
the
future,
I
give
it
a
meaningful
name.
Put
it
in
my
bin
folder,
then
I'll
be
able
to
find
it
again
and
use
it,
but
loads
of
times,
I,
write,
one-off
Scripts
I
would
always
call
them
zap
or
Pal.
B
Quick
games,
quick
on
the
keyboard,
sat
pal,
get
it
done
kind
of
thinking
of
the
cartoons
as
well
as
that
power.
Like
that,
so
I
was
trying
to
think
of
names
and
those
two
kind
of
kept
on
coming
back
and
is
that
kind
of
like
well,
you
can
zap
a
website.
You
know
it's
kind
of
a
likes
that
you
know
attacking
type
thing,
so
that
seems
to
make
sense,
but
because
it
came
from
this
cartoon
thing
onto
me,
capitals,
so
pretty
big
capitals.
The
easiest
way
is
to
make
an
accurate
it's
an
acronym.
B
So
it
stands
for
something,
but
obviously
I've
got
that
thing
first,
so
we
call
them
backer
names
where
you
you
fight.
You
know
you
come
up
with
a
term
first
and
you
find
work
out
what
it
stands
for
afterwards.
So
zap
P
for
proxy
nice
and
easy
a
for
tag.
Didn't
take
me
too
long.
I
must
admit
Zed.
What
can
Z
stand
for
I
couldn't
think
of
anything,
however,
so
I
thought
Zed
can
stand
to
Z,
but
I
didn't
want
Americans,
calling
it
Z
yeah,
it
doesn't
sound
right.
Does
he
attacked
proxy?
B
No
sorry
to
America.
So
Z
stands
for
z,
z,
e
d
and
it
kind
of
ties
in
a
bit
with
Led
Zeppelin
as
well,
because
they
called
Led
Zeppelin.
He
was
reading
LED.
They
changed
it
to
LED,
so
it
would
be
led
rather
than
lead
Zeppelin.
It
was
kind
of
a
bit
of
pla.
You
know
that
reminded
me
of
that
as
well,
so
you
know
there's
a
there's
a
bit
of
a
not
like
the
American
pronunciation,
a
bit
of
Led
Zeppelin
in
there,
those
kind
of
things.
B
No
I
mean
the
the
originally.
The
logo
was
wondering
about
having
like
a
ray
gun
or
something
like
that,
but
we
just
went
to
the
community
and
said
yeah.
What
should
it
be?
Can
anyone
you
know
we're
not
particularly
artistic
in
the
court
team
come
up
with
a
logo
and
someone
came
up
with
the
the
lightning
bolt
logo
and
yeah
that
works.
So
so
that's
what
we've
stuck
with
really
but.
A
C
B
So
I
mean
the
thing
is
what
we're
trying
to
do
is
and
the
whole
reason
for
that
is
to
make
things
more
secure,
we're
the
good
people.
You
know
we're
not
the
bad
guys,
and
so
it's
very
important
to
only
attack
things.
You
have
permission
to
attack
now.
The
easiest
way
to
do
that
is
to
actually
attack
your
own
Services,
your
own.
So
something
like
budget
I'm
running
on
my
MacBook
right
now
and
there
are
actually
loads
of
you
know
either
if
you're
writing
something
yourself.
B
You
know
vulnerable
web
applications
directory
V,
wad
mobile
Speedway
I'd
have
searched
for
it
and
there's
loads
of
delivery,
vulnerable
applications.
Some
of
them
are
online
things
like
Google
firing
range,
but
a
lot
of
them.
You
can
download
and
run
them
locally.
So
do
that
and
that's
a
great
way
to
learn.
A
B
I've
not
told
this
is
this
is
not
public
knowledge,
so
you
know
of
the
rest
of
the
team
now
I'm
working
on
it,
but
one
of
the
problems
with
modern
web
applications
is
so
much
is
actually
running
in
the
browser
and
what
we've
got
something
called
a
heads-up
display
which
brings
that
into
the
browser,
but
the
way
that
works.
It
injects
content
into
the
web
application.
It's
it
does
some
horrible
things,
it
works,
but
it's
nasty,
but
what
we
want
to
make
sure
is
we
have.
B
We
need
to
have
more
presence
in
the
browser
work
out.
What's
going
on
so
I'm,
actually
working
on
a
sap
browser
extension,
and
this
will
run
in
both
Chrome
and
Firefox,
and
one
of
the
reasons
we
can
do
it
now
is
when
we
launch,
when
we
launch
browsers
from
within
zap,
we
can
include
browser
extensions.
So
that's
what
we'll
do
I
mean?
B
It'll
be
optional,
initially,
it'll
be
quite
a
while
before
we
do
automatically
other
thoughts,
but
if
you
download
the
new
add-on
which
isn't
available
yet
but
hopefully
relatively
soon,
then
there'll
be
a
browser
extension,
so
so
Sap's
presence
in
the
browser,
and
that
means
we
can
do
a
lot
of
things.
We
can
passively
monitor
the
Dom
and
we
can.
What
we're
trying
to
do
is
find
out
more
information,
the
browser
and
stream
that
back
to
zap
and
display
it
there
there's
loads
more
things.
B
C
B
A
B
B
Hundreds
of
people
contributed,
but
what
we
have
is
there's
loads
of
different
ways
to
contribute,
and
we
have
a
page
on
zaproxy.org
you'll
be
able
to
find
it
go
to
the
menu
I
think
there's
even
a
contribute
menu,
so
there's
a
whole
different
section
of
pages,
and
it's
all
things
like
I'm
just
liking,
the
the
repos
followings
at
a
proxy
on
Twitter.
You
know
simple
things
like
that:
you
can
do
you
can
help
with
documentation.
You
can
help
with
testing
zap.
B
You
know,
there's
all
these
vulnerable
web
apps
out
there
I
would
love
to
runs
up
against
them.
We
we're
running
zap
against
a
whole
set
of
websites
every
night
and
we
publish
results
they're
available
on
dailyproperty.org,
but
there's
loads.
You
know,
there's
about
half
a
dozen
we're
doing
at
the
moment
and
that
hundreds
of
delivery
vulnerable
web
apps
would
like
to
publish
how
zap
does
against
all
of
them.
You
won't
get
commercial
tools
doing
this.
B
We're
open
source,
we
can
do
it,
so
you
know
we
would
love
to
get
people
running
zap
against
things
and
we're
a
girl
on
umos
slack
today
saying
you
know,
I
tried
to
app
against
this
and
it
didn't
find
this
Dom
access
from
ability.
I
think
you
should
be
using
this
attack.
It's
like
great.
This
is
what
we
want
to
hear
by
the
way
where
you
found
the
source
code.
That's
where
it
is.
Would
you
like
to
help
so
I'll?
Give
it
a
go
great
yeah?
This
is
what
we
want.
B
We
want
people
to
get
involved.
So
if
it's
just
telling
us
you
know,
some
zap
doesn't
find
false
negatives.
Stuff,
Zap
Says
is
vulnerable,
false
positives.
We
want
to
know
those
we
want
to
make
that
better
and
there's
loads
of
ways
you
can
help.
Just
go
onto
the
website
have
a
look
zaproxy.org
and
there's
pages
and
pages
of
ways
how
you
can
contribute.
B
C
C
B
B
You
know
that
automate
things
up
against
thousands
of
websites.
How
do
we
get
zap
to
be
the
best
it
can
for
all
these
different
use
cases
it's
impossible.
So
we
try
and
get
it.
You
know
what
we
think
is
best,
but
in
the
end
you
need
to
tune
zap.
So
zap
is
insanely
tunable
much
more,
so
the
most
Community
commercial
tools.
So
things
like
the
the
rules,
you
can
say
exactly
which
rules
sap
runs,
and
you
can
also
so
we've
got
the
Reese
quality
rules.
B
We
have
beta
quality
rules,
we
have
Alpha
quality
rules
and
every
rule
has
thresholds,
so
thresholds
can
be
the
average
what
we
think's
right.
We
have
a
low
threshold,
which
means
that
reports
more
things
more
chance
of
false
positives,
the
high
threshold,
whereas
that
will
report
less
than
things.
But
there's
more,
you
know
less
chance
of
false
positives
or
more
chance
of
false
negatives.
Then
the
attack
rules,
we
have
strengths,
so
we
have
a
low
strength
where
sample
do
fewer
attacks
so
be
quicker,
but
you'll
miss
things.
We
have
kind
of
medium
and
High.
B
We
have
an
insane
strength
as
well,
which
we
don't
really
recommend
running
in
automation,
because
you
know
that's
where
you
pick
on
one
particular
parameter
on
one
page
and
just
go
crazy
on
that.
Maybe
so
zap
is
really
configurable
and
it's
good
to
learn
about
zap
and
learn
how
to
configure
it.
And
one
thing
is
zap
knows
nothing
about
your
application
until
it
starts
interacting
with
it.
So
there's
a
lot
of
configuration
things
like
if
you,
if
you're
doing
a
black
box
testing,
then
you
don't
know
anything
about
it
either.
B
But
if
you
say
you're
the
developer,
you
know
that
your
application
is
using
MySQL
and
it's
not
using
Oracle
or
SQL
Server.
So
you
can
tell
that
by
the
technology
tab
that
it's
using
MySQL,
it's
not
using
Oracle
or
any
other
database.
That
means
that
will
only
do
the
MySQL
attacks
and
it
won't
do
the
others,
so
be
quicker
and
less
chance
of
false
positives
for
those.
B
B
If
you're
testing
using
zapod
hundreds
of
applications,
it's
harder,
we
would
love
to
I
mean
I've,
always
wanted
to
be
able
to
kind
of
get
zap
to
configure
itself.
This
is
hard
because
that's
interesting,
we
don't
get
the
feedback
about
these
things.
You
know
so
it's
very
hard
for
us,
but
one
thing
I
put
in
recently
is,
as
I
said,
we've
got
these
two
spiders.
We've
got
the
traditional
spider,
which
is
Fast
and
Furious,
but
doesn't
handle
modern
web
apps.
B
Then
we
have
the
Ajax
spider
which
handles
modern
web
apps,
which
are
not
slower.
Now,
if
you're
testing
a
lot
of
applications,
how
do
you
know
which
to
use?
So
what
we
have
in
the
automation
framework
is
the
Ajax
spider
has
an
option.
What
you
do
you
run
the
standard
spider?
Then
you
wait
for
the
passive
scan
to
finish
so
passive
scan
is
going
on
the
background.
We've
got
multiple
threads
now,
so
it's
a
bit
quicker,
but
one
of
the
passive
scan
rules
tries
to
detect
whether
it's
a
modern
web
application.
B
If
it
is
it,
doesn't
it's
not
a
vulnerability,
it
raises
an
info,
but
that
means
when
the
Ajax
spider
comes
along.
It
looks
for
that
alert.
So
it
goes
okay.
So
it's
it's
a
modern
web
application.
I
need
to
run
if
it's
not
a
mod.
If
there's
no,
if
that
alert
hasn't
been
raised,
one
of
the
things
it
checks
just
to
see,
whether
that
look,
that
rule
is
actually
installed.
If
it's
not
installed
and
not
enabled,
then
it
won't
run
anyway.
B
The
HX
part
has
got
to
run,
but
if
it
knows
that
it
was
installed
and
could
have
run
and
didn't,
then
it's
an
old
it's
a
traditional
app.
We
don't
need
to
run
the
Ajax
spider.
So
let's
speed
things
up
so
there's
all
those
kind
of
things
we
can
do
of
that
kind
of
thing
and
loads
more
to
try
and
detect
different
Frameworks,
but
yeah
we
need.
We
need
more
feedback
from
the
community.
You
know
we
don't
have
this
huge
number
of
real
world
applications
to
test
so
yeah.
A
That's
so
awesome.
All
right,
I
have
like
like
a
couple
questions,
I
guess
from
the
audience
and
then
we'll
pivot
into
the
non-technical
questions.
And
actually
it
looks
like
fall.
I
just
want
to
shout
out
Fallen
Valkyrie
because
they
seem
to
know
a
lot
about
zap
I,
don't
know
if
they're
like
a
core
contributor
or
they
just
use
it
heavily,
but
they
they
commented
that
zap
is
apparently
so
big
that
not
even
hardcore
pen
testers
use.
A
B
We
actually
have
apis,
so
zap
has
its
own
API
and
I.
Believe
it's
you
know.
It's
I
mean
it's
not
everything.
There's
some
fuzzing
stuff.
We
can't
do,
but
it's
probably
a
more
complete
API
than
pretty
much
any
commercial
tool
out
there,
but
we
also
generate
clients.
So
we
have
python
client
and
a
go
client
and
they
probably
could
do
it
being
a
lot
better
and
on
the
python
side
we
do.
We
actually
have
package
scans
which
are
written
in
python
and
a
lot
of
the
infrastructure.
B
A
lot
of
the
tooling
is
written
in
python
as
well
for
our
build
servers
and
stuff.
So
there's
definitely
things
that
could
help
with
on
both
of
those,
particularly
in
the
API
side.
But
the
other
thing
is
it's
actually
fun
learning
new
languages,
so
you
know
I
see
myself
as
a
Jr
developer,
but
I.
You
know:
I
write,
JavaScript,
I'm,
learning,
typescript
I've
written
some
go
I
use
Python.
Quite
a
lot.
I
wouldn't
restrict
yourself
off
to
one
language
as
a
developer
and
to
tie
into
the
other
thing
about
professional
pen.
Testers.
B
A
lot
of
professional
pen,
testers
I,
said
before
they're
no
book,
that's
right,
but
you
shouldn't
tie
yourself
to
one
tool.
You
should
learn
all
the
top
tools
out
there
and
I
think
the
Zapp
has
proved
itself
as
a
top
tool.
So
you
know
you
shouldn't
restrict
yourself
to
one
tool.
You
shouldn't
restrict
yourself
to
one.
You
know
as
a
pen
tester,
you
shouldn't
just
use
one
for
12
or
one
thing
as
a
developer,
you
shouldn't
look,
you
just
use
one
language,
you
learn
so
much
more
from
different
languages.
B
You
know,
JavaScript
is
weird,
but
I've
learned
a
lot
from
it.
I
wouldn't
like
to
write
a
big,
complex
application
with
it.
Typescript,
maybe
you
know
so
I
had
to
play
around
with
rust,
because
that's
hard,
but
you
know
it's.
These
are
fun
things
to
do.
You
should
learn
and
grow
and
play
with
different
tools
and
techniques
and
languages.
A
B
Yeah
so
the
hard
the
heads-up
display
that
everything
that
runs
in
the
browser
is
written
in
JavaScript
and
then
it
makes
API
calls
back
to
zap
where
it's
written
in
Java,
so
but
all
of
the
HUD
side
is
Javascript
and
this
new
browser
extension
I'm.
Writing
in
writing.
That
is
typescript
again
with
Java
back-end
stuff
in
but
yeah.
So
those
are
the
two
projects
that
use
JavaScript
typescript.
A
B
In
a
few
days,
there
is
a
blog
post,
which
I
think
is
aimed
to
go
live
tomorrow,
so
I've,
actually
just
we
just
written
a
blog
post
for
there's
so
much
happening
in
zap,
which
I
don't
think
people
are
aware
of.
So
we
now
do
monthly
blog
posts
at
the
end
of
each
month.
So
there's
one
for
September
I'm
released
an
insane
number
of
add-ons
forgotten
how
many
now,
but
it's
just
crazy
numbers,
there's
loads
of
stuff
going
on
in
there.
B
A
That's
awesome
and
for
anyone
listening
in
who
doesn't
know,
I
have
12
professors,
it's
an
annual
event
in
October,
where
everyone
does
a
little
bit
of
a
focus
on
contributing
to
open
source.
So
if
you've
never
contributed
before.
This
might
be
a
perfect
time
for
you,
because
a
lot
of
times,
maintainers
label
issues
good
for
issues
which
are
like
issues
that
are
good
for
newcomers
to
work
on
cool.
B
A
C
A
A
A
B
C
A
A
A
B
A
C
Just
wanted
to
say
that
I
really
enjoyed
the
session
today,
because
Simon
addressed
pressing
questions
coming
straight
from
the
developer
audience
like
questions
that
every
developer
has
about
dust
sauce,
how
they
can
benefit
from
from
zap
what
the
features
are
on
and
how
it's
evolving
to
what
is
today.
So
it's
a
it's
a
huge
thanks
to
Simon
from
my
side
as
well
and
I
just
want
to
tell
the
audience
that
we
are
preparing
another
security
guest.