Web应用安全测试框架：以OWASP的ZAP V2.12.0与V2.13.0为例进行基准测试
Security Testing Framework for Web Applications: Benchmarking ZAP V2.12.0 and V2.13.0 by OWASP as an example
AI总结：
本研究以OWASP Benchmark v1.2为基准，对比OWASP ZAP V2.12.0与V2.13.0的漏洞检测性能，为Web应用安全测试工具的选择及研究发展提供参考。
摘要：
Web应用的使用量大幅增长，引发了对其安全漏洞的担忧，这进而推动人们寻求可靠的安全测试工具。本研究以OWASP Benchmark项目（一款故意植入漏洞的应用）为测试对象，对开源Web应用漏洞扫描工具领域的领先产品——OWASP ZAP的两个最新版本的性能进行了对比评估，考察其在识别安全漏洞方面的效率。研究方法为使用OWASP ZAP的v2.12.0和v2.13.0版本对OWASP Benchmark进行系统性扫描；OWASP Benchmark提供了标准化框架，用于评估扫描工具识别安全缺陷的能力，涵盖不安全Cookie、路径遍历、SQL注入等多种漏洞类型。本次基准对比获得的结果，为该工具各版本的优势与不足提供了有价值的见解，有助于Web应用安全测试领域，让人们了解知名扫描工具识别漏洞的表现。研究所得知识可帮助安全专业人员和开发人员做出明智决策，以提升其Web应用的安全状态。综上，本研究使用OWASP Benchmark v1.2全面分析了ZAP的安全缺陷检测能力，相关发现丰富了关于在线应用安全工具的持续讨论，并为Web应用安全测试研究领域的未来研究与发展奠定了框架。
英文摘要：
The Huge growth in the usage of web applications has raised concerns regarding their security vulnerabilities, which in turn pushes toward robust security testing tools. This study compares OWASP ZAP, the leading open-source web application vulnerability scanner, across its two most recent iterations. While comparing their performance to the OWASP Benchmark, the study evaluates their efficiency in spotting vulnerabilities in the purposefully vulnerable application, OWASP Benchmark project. The research methodology involves conducting systematic scans of OWASP Benchmark using both v2.12.0 and v2.13.0 of OWASP ZAP. The OWASP Benchmark provides a standardized framework to evaluate the scanner's abilities in identifying security flaws, Insecure Cookies, Path traversal, SQL injection, and more. Results obtained from this benchmark comparison offer valuable insights into the strengths and weaknesses of each version of the tool. This study aids in web application security testing by shedding light on how well-known scanners work at spotting vulnerabilities. The knowledge gained from this study can assist security professionals and developers in making informed decisions to support their web application security status. In conclusion, this study comprehensively analyzes ZAP's capabilities in detecting security flaws using OWASP Benchmark v1.2. The findings add to the continuing debates about online application security tools and establish the framework for future studies and developments in the research field of web application security testing.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
