I am following this tutorial for an application based in spring framework 3.2.4

http://springdiaries.blogspot.be/2012/12/web-security-preventing-csrf-attack.html#comment-form

The point is that I've checked all the objects in the session and I haven't found any object with the Key OWASP_CSRFTOKEN, and that is susposius that in not working well ?

Web Security: Preventing CSRF attack

I am currently planning to do some web application vulnerability testing on an EC2 server with OWASP ZAP.

From my very quick google search, I found that AWS has stated that penetration testing services are allowed without approval (https://aws.amazon.com/security/penetration-testing/).

However, to double down, I am wondering if anyone in the community has done this without issue.

Performing web application vulnerability testing on an EC2 server with OWASP ZAP is a great approach to assessing the security of your web applications hosted on AWS. Below is a step-by-step guide to help you get started:

Launch an EC2 instance on AWS with the appropriate configuration for your web application. Ensure that the security group associated with the EC2 instance allows access to the necessary ports for running and accessing OWASP ZAP.

Use SSH to connect to your EC2 instance securely. You will need the public IP address or DNS name of the EC2 instance to access it.

Install OWASP ZAP on the EC2 instance. You can follow the official documentation for installing OWASP ZAP on your specific operating system. For example, if your EC2 instance runs Ubuntu, you can use apt to install ZAP.

Run OWASP ZAP in headless mode on the EC2 instance. Headless mode allows you to run ZAP without a graphical user interface (GUI), which is necessary for server environments like EC2 instances. You can start ZAP in headless mode using the following command:

zap. sh -daemon -host 0.0.0.0 -port 8080 -config API.disablekey=true

This command starts ZAP in daemon mode, binds it to all available network interfaces (0.0.0.0), on port 8080, and disables the API key for easier integration with automation.

If you want to access the OWASP ZAP GUI remotely for monitoring or configuration purposes, you can set up a secure tunnel using SSH port forwarding. This way, you can access ZAP's GUI from your local machine via SSH. Use the following command on your local machine:

ssh -i /path/to/your/key.pem -L 8080:localhost:8080 ec2-user@your-ec2-public-ip

Ensure your web application is running and accessible from the EC2 instance's public IP or DNS. Make sure your web application is in a test environment, as vulnerability testing can have unintended consequences.

On your local machine or the machine from where you are running the ZAP GUI remotely, configure your web browser's proxy settings to point to the OWASP ZAP instance running on the EC2 server. Set the HTTP and HTTPS proxy to the EC2 instance's IP and port 8080.

With the proxy settings configured, access your web application using your browser. OWASP ZAP will intercept and capture the traffic, allowing you to perform various security tests and scans.

After performing the security tests, analyze the results in the OWASP ZAP GUI or through its reporting capabilities. Address any vulnerabilities and retest as needed.

If you need to retain the test results, securely store them and follow any relevant data protection guidelines. Be cautious not to expose sensitive information inadvertently.

Using OWASP ZAP (and tools of the same purpose) on AWS EC2

I have a simple interface but I work with multiple APIs so I don't want to use a backend for it. How can I hide my API keys in CRA without using backend.

It is suggested to use environment variables for this and I have also used it as shown in the documentation but this is not exactly what I want. Even though I use environment variables , a simple CTRL + F search in the "chunk.js" files reveals things that should remain hidden, like my API keys. Is there a way to completely prevent this?

owasp

Trending Blogposts on owasp

Popular Discussions on owasp

openWeb Security: Preventing CSRF attack

1

0

0

openUsing OWASP ZAP (and tools of the same purpose) on AWS EC2

2

1

0

openHow can I keep my hidden fields like api key after getting bundle in CRA

0

0

0

PRODUCTS

QUICK LINKS

LEGAL