Options on ZAP

Client Certificates

Mon, 01 Jan 0001 00:00:00 +0000

Client Certificates

This screen allows you to add a client certificate to use when testing applications protected using mutual SSL.
After adding the certificate it can be set as active in the KeyStore tab.
Unlike other options screens, the changes done to the keystore are not undone if the Options dialogue is cancelled.

Connection

Mon, 01 Jan 0001 00:00:00 +0000

Connection

General

This tab allows you to configure the general connection options.

Timeout (in seconds)

Allows to configure the connection and read timeout, a higher timeout allows to test slower applications.
Default: 20.

Global Exclusions

Mon, 01 Jan 0001 00:00:00 +0000

Global Exclusions

The URLs/domains that should be ignored by the local proxies and scanners/tools. The Value is a regular expression matched against the requested target.


	Network	the introduction to Network add-on

Local Servers/Proxies

Mon, 01 Jan 0001 00:00:00 +0000

Local Servers/Proxies

This tab allows you to configure the addresses and ports on which ZAP accepts incoming connections.

Main Proxy

By default ZAP will listen on one local address and port, and usually these should be the address and port that you must configure your browser to use as a proxy.

Rate Limit

Mon, 01 Jan 0001 00:00:00 +0000

Rate Limit

The Rate Limit feature limits the request rate of HTTP/HTTPS (not web sockets) traffic to hosts or domains to prevent overloading the target or being blocked. The limit is applied using a matcher against the request host to pick an individual host, an entire domain, or anything between. In the case a host matches multiple rules, the rule with the most restrictive rate is used.

Server Certificates

Mon, 01 Jan 0001 00:00:00 +0000

Server Certificates

This screens allows to manage and configure the root CA certificate and issued certificates.

ZAP allows you to transparently decrypt SSL connections. For doing so, ZAP has to encrypt each request before sending to the server and decrypt each response, which comes back. But, this is already done by the browser. That’s why, the only way to decrypt or intercept the transmission, is to do a ‘manipulator in the middle’ approach.

Options on ZAP

Client Certificates

Client Certificates

Connection

Connection

General

Timeout (in seconds)

Global Exclusions

Global Exclusions

See also

Local Servers/Proxies

Local Servers/Proxies

Local Servers/Proxies

Main Proxy

Rate Limit

Rate Limit

Rate Limit

Server Certificates

Server Certificates