14.12. Penetration testing¶
14.12.1. Via OWASP Zed Attack Proxy (ZAP)¶
Get ZAP going:
Download ZAP, e.g. as the Linux installer.
Run the installer, e.g. via
sudo ZAP_2_9_0_unix.sh. By default it installs to
Run ZAP with
Say no to “Do you want to persist the ZAP Session?”
Get CamCOPS going:
Make sure your CamCOPS configuration file doesn’t have any “developer low-security” flags set. Thus, ensure:
ALLOW_INSECURE_COOKIES = False # ... if set to True, you will get the alerts: # - Cookie No HttpOnly Flag # - Cookie Without Secure Flag
Fire up CamCOPS, e.g. with
Then test. Perform the following tests. Every time you change code and re-attack, delete all previous alerts (or you won’t know if you’ve fixed them). Once you’re eliminated all alerts (except exempted ones as below), proceed to the next attack.
In “Quick Start”, click “Automated scan”, enter the CamCOPS root URL (e.g.
https://127.0.0.1:8088/) into ZAP and click “Attack”. This performs an automatic scan without login.
Attack the client API, e.g.
Attack the rest of the site.
In “Quick Start”, click “Manual Explore”. Choose the root URL again, launch Firefox from ZAP (with a fancy HUD!), log in, and explore.
Do the ZAP HUD tutorial the first time round. (Delete the cumulative alerts after this!)
Mark the CamCOPS local site as “in scope”.
Turn on Attack Mode.
Browse and watch the data fly.
The attacks will lock out your user at some point; use
enable_user to re-enable it.
Alerts not fixed, as they relate to third-party code and are low risk, or are deliberate:
Information Disclosure - Suspicious Comments(risk: “Informational”) in
Timestamp Disclosure - Unix(risk: “Informational”) in
Application Error Disclosureat
/crash– that is the point of the
/crashpage, available only to superusers.