project / 05Application security
Web Application Security Testing
OWASP ZAP assessment of a deliberately vulnerable test site, with findings and mitigations.
View source updated
- Stack
- OWASP ZAP
- OWASP Top 10
- Web security
Overview
An internship task: a structured assessment of testphp.vulnweb.com (a public, intentionally vulnerable test site) using OWASP ZAP 2.16.1, from spidering and active scanning through manual validation to a written report with severities and mitigations.
Problem
Find, rate and explain the weaknesses in a web application the way a client report would.
Approach
Run ZAP's spider and active scanner, verify the results by hand, and document each finding with impact, severity and mitigation.
Implementation
- Recommended adding the missing security headers flagged by the scan: Content-Security-Policy, anti-clickjacking (X-Frame-Options) and X-Content-Type-Options.
- Also flagged absent anti-CSRF tokens.
Findings
| Finding | Severity | Mitigation |
|---|---|---|
| SQL Injection | High | Unsanitised input; fix with parameterised queries and strict input validation. |
| XSLT Injection | Medium | Manipulable XML transformations; sanitise XML input and use safe parsers. |
| Server information leak | Low | Version details in Server and X-Powered-By headers; remove or obfuscate them. |
| Modern Web Application | Informational | Framework disclosure; keep framework configuration hardened and updated. |
Key features
- Spidering, active scanning and manual validation
- SQL injection (High) and XSLT injection (Medium) findings
- Server version disclosure via Server / X-Powered-By headers
- Mitigations for each finding
Security concepts
- Injection flaws
- Security misconfiguration
- HTTP security headers
- OWASP Top 10 mapping