Upotreba alata ZAP kao zamjena za alat Burp Suite Professional

undergraduate thesis

• Title (english): Using ZAP tool as alternative to Burp Suite Professional
• Author: Ante Čavar
• Mentor: Stjepan Groš (mentor)
• Committee member: Stjepan Groš (predsjednik povjerenstva)
• Committee member: Petar Paradžik (član povjerenstva)
• Committee member: Josip Jukić (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2024-07-01, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Computing

Abstract

Cilj ovog rada bio je usporediti Burp Suite Professional i OWASP ZAP. Prije svega
smo usporedili njihove značajke po dokumentaciji a zatim smo ih testirali u sigurnom
okruženju. Oba alata su se pokazala izuzetno korisnima i sveobuhvatnima te bilo koji
problem možemo riješiti neovisno o izboru između ta dva alata. Uz to da su oba alata izuzetno korisna također vrijedi nadodati kako oba posjeduju mogućnost proširenja kako bi
zadovoljili svačijim potrebama. Pokazali smo zašto je ipak ZAP malo bolji izbor pogotovo
za male tvrtke i pojedince te kako ga možemo automatizirati jednostavnim skriptama.
Na kraju smo ipak zaključili kako su oba alata jednako bitna te odluku koji će biti
iskorišten u kojem trenutku ovisi o budžetu, znanju, iskustvu i situaciji. Ne postoji jedan
alat koji može zamjeniti sve ostale ali činjenica da postoje više od jednog je zdrava za
razvoj, održavanje i unaprijeđivanje svih alata na tržištu.

Abstract (english)

The aim of this paper was to compare Burp Suite Professional and OWASP ZAP. First,
we compared their features according to the documentation, and then we tested them in
a secure environment. Both tools proved to be extremely useful and comprehensive, and
any problem can be solved regardless of the choice between these two tools. In addition
to both tools being extremely useful, it is also worth noting that both have the capability
for extension to meet everyone’s needs. We have shown why ZAP is still a slightly better
choice, especially for small companies and individuals, and how we can automate it with
simple scripts.
In the end, we concluded that both tools are equally important, and the decision on
which one will be used at any given moment depends on budget, knowledge, experience,
and situation. There is no single tool that can replace all others, but the fact that there
are more than one is healthy for the development, maintenance, and improvement of all
tools on the market.

• Keywords: web sigurnost; OWASP; Burp Suite; penetracijsko testiranje; automatizacija; PortSwigger; ZAP
• Keywords (english): web security; OWASP; Burp Suite; penetration testing; automation; PortSwigger; ZAP
• Language: croatian
• URN:NBN: urn:nbn:hr:168:766239
• Study programme: Title: Computing; Study programme type: university; Study level: undergraduate; Academic / professional title: sveučilišni/a prvostupnik/ prvostupnica (baccalaureus/baccalaurea) inženjer/inženjerka računarstva (sveučilišni/a prvostupnik/ prvostupnica (baccalaureus/baccalaurea) inženjer/inženjerka računarstva)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2024-10-12 20:19:30