Professionally Evil Insights

Professionally Evil Blog

A blog by experts of penetration testing and other security assessments.

Testing, open source, web penetration testing, OWASP, mobile application, web application security, API

ZAPmas Feedback

Sometimes Christmas comes early, and in this case for me it was the publication of the Twelve Days of ZAPmas blog posts by Mic Whitehorn-Gillam. If you have not read them yet then please do - they are a great introduction to ZAP and provide what I think is a very fair and balanced comparison to ...

Learn more

Never miss a Professionally Evil update!

Testing | application security | OWASP | web application security

Twelve Days of ZAPmas - Day 12 - Testing a new Content-Security-Policy

What is the CSP? The Content-Security-Policy (CSP) is a widely recommended control and is ...

Learn more

web penetration testing | Burp Suite | OWASP | web application security

Twelve Days of ZAPmas - Day 11 - ZAP impressions from a Burp user

It probably seems a bit odd to do this on Day 11 and not at the end of the series, but I have one ...

Learn more

web penetration testing | OWASP | web application security

Twelve Days of ZAPmas - Day 10 - Manual Web App Testing Unproxied

Most of the time, proxying the browser doesn’t present any sort of trouble. You should be able to ...

Learn more

OWASP | web application security

Twelve Days of ZAPmas - Day 8 - Spidering

Spidering is an automated process that recursively finds and follows all the navigation from an ...

Learn more

application security | OWASP | web application security | scanning

Twelve Days of ZAPMAS - Day 6 - Passive Flaw Detection and Using the HUD

One of the awesome things about a security-focused interception proxy like ZAP is its ability to ...

Learn more

application security | OWASP | web application security | scope

Twelve Days of ZAPmas - Day 5 - Scope and Contexts

Normally I don’t like having my interception proxy hide out-of-scope traffic. Doing so creates a ...

Learn more

web penetration testing | application security | web application security | how-to

Twelve Days of ZAPmas - Day 4 - Fuzzing for Injection

I briefly introduced fuzzing earlier in the series, citing it as the second primitive upon which ...

Learn more

application security | OWASP | web application security | how-to

Twelve Days of ZAPmas - Day 3 - CYA (Cover Your Auth)

Access control is one of the crucial elements to application security. The vast majority of ...

Learn more

Twelve Days of ZAPmas - Day 2 - The Edge of Tomorrow

Day 2 - The Edge of Tomorrow - Replaying and Tampering with Requests Fuzzing and tampering are like ...

Learn more

web penetration testing | application security | OWASP | web application security | how-to

Twelve Days of ZAPmas - Day 1 - Setting Up ZAP

This holiday season, I’m going to run down some of the ins and outs of working with OWASP Zed ...

Learn more

Training | web penetration testing | application security | web application security

Coming Soon - Twelve Days of ZAPmas

In December of 2018, I published a twelve-day series of cross-site scripting tips, tricks, and ...

Learn more

1 2