Shulou(Shulou.com)06/01 Report--

Premise:

Download the installation package, I have put it on the Baidu network disk for windowsX64 2.7.0, if you need it, you can go to the address to download: https://pan.baidu.com/s/1S4yDP7aFiEzSO41c_817vQ

Since the ZAP tool is based on java, the computer must install and configure the jdk environment. I installed 1.8.0.

Installation and use:

The installation package is .exe, and you can Next all the way. After opening it, it looks like the following:

I built the test environment on this machine, which is the site, so I need to set the browser proxy and ZAP proxy to 127.0.0.1, and the port number is the same.

ZAP setting proxy: tools option

Then select Local Proxies, enter the ip address and port number, and click the OK button.

Visit the URL of this site in the browser (do not write localhost or 127.0.0.1, write the corresponding ip address) and log in, ZAP can catch the package

Right click in the login url and select Fuzz...

After replacing the text that needs to be replaced with a dictionary, click the Start Fuzzer button and start brute force cracking.

After brute force cracking is completed, you can sort the response body.In general, the response body is returned in error with the same size, and the request with different response size is found, that is, the correct user and password

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.