Just like that, only one P, only one T,
then we're gonna hit that button. It's gonna ask me for my password.
Let that sucker go into play
and let it do its thing.
So this will take a minute to get installed
depending on how fast or slow your machine is.
Uh, it could take a few minutes.
All right. Once it's in there, we're actually going to start it
and to start it, we type in
app
that the
app
and let's do that switch or that T
age to get that help menu
and you can see that it's gonna go through
and identify whether or not it's working or not.
It's also gonna give this manual for us
and we can see the little
captions right here and all this other good stuff. Now,
a
zap, the nice, really nice thing about it is it actually has a gooey interface.
So to use that goer interface,
we're just gonna type in
a
WASP,
the SAP
and it's gonna boot up for us.
Now, the first time it boots up,
it's gonna take a few minutes because I gotta download some stuff
and it says do I want to do the persistence? Do I not want to do the persistence?
What do I want to do? I'm gonna say no,
I don't want a persistent session at this time.
Uh I'm not gonna remember my choice. I'm gonna go ahead and press start.
Let me blow this up so you can see it.
And it's gonna ask me, do I want to update all these items? I recommend
you update everything.
I'm just weird like that. I like updated software. I know it's weird. Right.
And again, let me blow this up
and then I can also press this update all button if I wanted to.
I'm just gonna update the selected because those are the ones that need an update
and it's gonna say yes and let it do its thing.
This again will take it a second to get up there
and you'll start to notice that everything has
been updated except for this one right here.
But for the interest of time, I'm just going to close that out. Let's
do that.
And here we go, let's go start using this tool. We're going to do an automated scan
and it's gonna ask me what the URL is now, I'm gonna use again, Kiari
two
and I'm just gonna type in that IP address right there.
Ok.
Once I'm done with that, I have some choices I can do Firefox headless chrome,
so on and so forth.
I'm gonna just use the default for purposes of exercise today.
And then I'm gonna hit that little attack button.
Let it do its thing.
Now it's gonna go through and it's gonna start scanning while it's scanning.
I want to point out some things to you.
There's the alerts button right here.
This alerts, tell us all the vulnerabilities that it's found so far.
It also has its output of different items that is
outputted based on what you've done in the past.
As a spider,
the spider is going through the web server and
it's looking for active directories that it can find
and then it has a s active scan which again goes through it. I'm gonna go to alerts.
I'm just gonna start with this red flag.
That's the most critical the SQL injections too.
I can press that little down arrow and I could click on a specific one if I wanted to.
And it's saying, hey, index dot PHP risk of high confidence medium
parameter, it's using a ES QOL
Injection. So if it did zap or one equals one,
that's the attack. It utilized.
It has AC we ID of 89
and it's saying SQL Injection may be possible,
may be possible if I scroll down a little bit over here
as saying other information,
the page results were successfully
manipulated using
boolean
and it says solution do not trust the site input even if
the client site is validated in place in general type all data,
yada yada yada and it gives me a reference to look at.
So it's telling me what I need to do
in order to provide a decent solution now
is the solution, the best case, probably not, right?
The best solution would go in there and do input validation
and make sure that the developers go through and make
sure that the the program or the software is not vulnerable
to input attack or SQL attack, right?
So whoever developed the website,
we will want them to go through and do that process,
right? So this is very quick, very down and dirty. This is
a was a
very, very easy to use.
Uh I like the
Yoy interface.
This is actually one of the programs that I I
truly enjoy because it makes it so simple to use.
I
hope you learned something as always have a good one.