Common Library on ZAP

Tabbed Output Panel

Mon, 01 Jan 0001 00:00:00 +0000

Tabbed Output Panel

The Common Library add-on provides a tabbed output panel that replaces the default output panel in ZAP. This allows other add-ons to optionally log messages under named tabs in the output panel. If a name is not provided, messages are shown under the “General” tab and exceptions are shown under the “Errors” tab by default.

Alert Tags

Mon, 01 Jan 0001 00:00:00 +0000

Alert Tags

The Common Library add-on provides Alert Tags for use by scan rules.

Of note the following tags/groups of tags are included:

Custom Payloads - A tag which indicates the scan rules which support Custom Payloads functionality.
HIPAA (Health Insurance Portability and Accountability Act) - A tag representing alerts/rules which we’ve mapped to the HIPAA standard.
OWASP Top 10 (2017) - Tags representing the risks/vulnerabilities from the 2017 OWASP Top 10 list.
OWASP Top 10 (2021) - Tags representing the risks/vulnerabilities from the 2021 OWASP Top 10 list.
PCI DSS (Payment Card Industry Data Security Standard) - A tag representing alerts/rules which we’ve mapped to the PCI DSS standard.
Test Timing - A tag which represent rules/alerts which are based on time (induced delay) payloads.
OWASP Web Security Testing Guide (v4.2) - Tags which map rules/alerts to the relevant sections of the OWASP WSTG (version 4.2).

Compliance Tags

Please note that the PCI DSS and HIPAA standards deal with specific types of data, while an identified vulnerability may expose such data ZAP has insufficient context with which to differentiate what is or might be exposed by leveraging a given vulnerability. If the system being tested does not hold any such data then the related compliance tag may not be relevant.

Generate Fix Prompt

Mon, 01 Jan 0001 00:00:00 +0000

Generate Fix Prompt

The Generate Fix Prompt right-click menu option is available on alerts in the Alerts tab. It generates a prompt that you can paste into any Large Language Model (LLM) — such as ChatGPT, GitHub Copilot, or Claude — and ask it to fix the vulnerability in your codebase.