Releases on ZAP

Release 2.17.0

Mon, 01 Jan 0001 00:00:00 +0000

Release 2.17.0

This is a bug fix and enhancement release.

Alert De-duplication

Changes have been made in order to reduce the number of alerts which ZAP may raise that are duplicates or highly similar, more closely being aligned with the Sites Tree representation. See the Alert De-duplication blog for further details.

Release 2.16.1

Mon, 01 Jan 0001 00:00:00 +0000

Release 2.16.1

This is a bug fix release, along with some minor enhancements.

This release was made possible thanks to Checkmarx who employ 3 of the Core Team to work on ZAP.

These release notes do not include all of the changes included in add-ons updated since 2.16.0.

The enhancements include:

Release 2.16.0

Mon, 01 Jan 0001 00:00:00 +0000

Release 2.16.0

This is a bug fix and enhancement release. Look out for new Blog Posts and Videos which will cover some of these new features in much more depth in the coming days and weeks.

This release was made possible thanks to Checkmarx who employ 3 of the Core Team to work on ZAP.

Release 2.15.0

Mon, 01 Jan 0001 00:00:00 +0000

Release 2.15.0

This is a bug fix and enhancement release.
These release notes do not include all of the changes included in add-ons updated since 2.14.0.

This release was made possible thanks to our biggest supporter, the Crash Override.

Some of the more significant enhancements include:

Scripts as First Class Scan Rules

Active and passive scan script rules can now be treated as “first class” scan rules. This means that they can be individually referenced in an active scan policy, in the passive scan rules options, and in Automation Framework plans. In addition directories of scripts can now be added with all of the scripts enabled - this will make it much more straightfoward to manage script rules in automation.

Release 2.14.0

Mon, 01 Jan 0001 00:00:00 +0000

Release 2.14.0

This is a bug fix and enhancement release.
These release notes do not include all of the changes included in add-ons updated since 2.13.0.

This release was made possible thanks to our Platinum Sponsor, the Software Security Project.

Some of the more significant enhancements include:

Rebranding and Docker Hub Move

ZAP has had some minor rebranding changes as a result of the move to the Software Security Project.

Release 2.13.0

Mon, 01 Jan 0001 00:00:00 +0000

Release 2.13.0

This is a bug fix and enhancement release.
These release notes do not include all of the changes included in add-ons updated since 2.12.0.

Some of the more significant enhancements include:

HTTP/2 Support

HTTP/2 is now supported, with no configuration changes required.

Release 2.12.0

Mon, 01 Jan 0001 00:00:00 +0000

Release 2.12.0

This is a bug fix and enhancement release, which now requires a minimum of Java 11.
As the main zaproxy/zaproxy repo has just reached 10k stars we’re calling this the ‘Ten Thousand Star’ Release!

This release fixes an HTML Injection vulnerability in the ZAP Desktop which was rated a P3 / Medium level vulnerability. While we do not think that it can be exploited in any meaningful way, desktop users are still recommended to update from older ZAP versions a.s.a.p.

Release 2.11.1

Mon, 01 Jan 0001 00:00:00 +0000

Release 2.11.1

This release includes an important security fix - users are urged to upgrade asap. For more details refer to the blog post ZAP and Log4Shell.

Changes in Bundled Libraries

The following library was updated:

Release 2.11.0

Mon, 01 Jan 0001 00:00:00 +0000

Release 2.11.0

This is the OWASP 20th anniversary bug fix and enhancement release, which requires a minimum of Java 8. Note that a minimum of Java 11 is recommended, especially for high DPI displays.

These release notes do not include all of the changes included in add-ons updated since 2.10.0.

Release 2.10.0

Mon, 01 Jan 0001 00:00:00 +0000

Release 2.10.0

This is a 10 year anniversary bug fix and enhancement release, which requires a minimum of Java 8. Note that a minimum of Java 11 is recommended, especially for high DPI displays.

These release notes do not include all of the changes included in add-ons updated since 2.9.0.

Release 2.9.0

Mon, 01 Jan 0001 00:00:00 +0000

Release 2.9.0

This is a bug fix and enhancement release, which requires a minimum of Java 8. Note that a minimum of Java 11 is recommended, especially for high DPI displays.

These release notes do not include all of the changes included in add-ons updated since 2.8.0.

Some of the more significant enhancements include:

Release 2.8.0

Mon, 01 Jan 0001 00:00:00 +0000

Release 2.8.0

This is a bug fix and enhancement release, which requires a minimum of Java 8. Note that a minimum of Java 11 is recommended, especially for high DPI displays.

These release notes do not include all of the changes included in add-ons updated since 2.7.0.

Some of the more significant enhancements include:

Release 2.7.0

Mon, 01 Jan 0001 00:00:00 +0000

Release 2.7.0

This is a bug fix and enhancement release, which requires a minimum of Java 8.

Some of the more significant enhancements include:

Browser launch included by default - this allows you to launch browsers from ZAP that are preconfigured to proxy through ZAP and ignore the certificate warnings due to the ZAP root certificate.
Allow ZAP to listen on multiple addresses/ports
Support Server Name Indication
Updated NTLM engine implementation - this fixes the cases where the domain is being validated and improves interoperability with other (server) NTLM implementations
Lots of new API endpoints - see below for details

Note that if you do have any problems with this release then there is also a new ‘Help/Support Info…’ menu item that provides essential information about your ZAP installation which you should include with any issues you raise.

Release 2.6.0

Mon, 01 Jan 0001 00:00:00 +0000

Release 2.6.0

This release contains a large number of changes, in particular to the ZAP API.
We have added a significant number of new API endpoints, working towards our goal of making ZAP completely controllable via the API. We have also changed some of the existing endpoints and in all cases these changes are backwards compatible.

Release 2.5.0

Mon, 01 Jan 0001 00:00:00 +0000

Release 2.5.0

The following changes were made in this release:

ZAP API Changes:

VIEW authorization / getAuthorizationDetectionMethod

Now returns data wrapped in an object called authorizationDetectionMethod For example:

Release 2.4.3

Mon, 01 Jan 0001 00:00:00 +0000

Release 2.4.3

The following changes were made in this release:

Enhancements:

Issue 1576 : Define URL path elements as ’non structural'
Issue 1711 : Feature request: Option to specify number of token to be generated.
Issue 1768 : Update to use a more recent user-agent
Issue 1894 : ZAP only scans “User-Agent”, “Referer”, and “Host” request headers
Issue 1911 : Search AJAX spider requests
Issue 1913 : Pass all params across to zap.sh - debian package
Issue 1914 : Multiple add-on directories
Issue 1920 : Report the host:port ZAP is listening on in daemon mode, or exit if it cant
Issue 1927 : Enhancement: Break only for in-scope URLs.
Issue 1944 : Chart responses per second in ascan progress
Issue 1953 : Allow to spider a context through the ZAP API
Issue 1962 : Install and update add-ons from the command line
Issue 1975 : RC4-SHA SSL cipher suite not supported
Issue 1980 : Add ZAP CLI to Docker images
Issue 1985 : Bring up the Modify dialog if the user doubles on a row in a AbstractMultipleOptionsBaseTablePanel
Issue 2009 : Add Online links to the FAQ and Newsletter pages
Issue 2084 : Warn users if they are probably using out of date versions
Issue 2086 : Report request counts per plugin
Issue 2088 : Support an ‘update all’ button for installing all updated add-ons
Issue 2094 : Support a ‘-addoninstallall’ command line option
Issue 2102 : Allow ajax spider options to be set via the API

Bug fixes:

Issue 1070 : Breaking on custom URL with query parameters does not work.
Issue 1555 : SAXParseException while generating the report
Issue 1617 : ZAP 2.4.0 throws HeadlessExceptions when running in daemon mode on headless machine
Issue 1877 : fix path to .ZAP_JVM.properties in zap.sh
Issue 1893 : Regression: Can’t disable and enable specific scanners through the API
Issue 1910 : API does not return content in the expected encoding, on errors
Issue 1917 : Request and Response tabs dont scale the text
Issue 1939 : Scripts - Save Button Enablement Issue
Issue 1949 : Script with missing type prevents scripts and templates from being loaded
Issue 1950 : Connection closed without response, with an Authentication script with errors
Issue 1951 : Exception when trying to add users before loading an authentication script
Issue 1960 : Active Scan dialogue might use outdated scan policy
Issue 1969 : Issues with installation of scanners
Issue 1970 : Installed add-on dependencies might not be taken into account when installing add-ons
Issue 1973 : Returned HAR/list does not contain correct redirection messages
Issue 1981 : Spider might not report the correct number of URIs found
Issue 2005 : Active scanning incorrectly performed on sibling nodes
Issue 2044 : Issues in Hirschberg’s algorithm implementation
Issue 2045 : Dont copy old configs if -dir option used
Issue 2052 : Authentication changes done through the API not saved to session


	Introduction	the introduction to ZAP
	Releases	the full set of releases
	Credits	the people and groups who have made this release possible

Release 2.4.2

Mon, 01 Jan 0001 00:00:00 +0000

Release 2.4.2

The following changes were made in this release:

Enhancements:

Issue 1306 : Java PermSize command line flag removed in Java 8
Issue 1593 : Auto-scroll in Spider tab
Issue 1600 : Dont report X-Frame-Options alert on 403 and 404 pages
Issue 1654 : httpSessions/createEmptySession should initialize a site that was not previously visited
Issue 1702 : Add “recurse” option to the spider API
Issue 1715 : Unable to pass arguments when launching ZAP from the command line on Mac OS X
Issue 1766 : Remove context via the API
Issue 1768 : Update to use a more recent user-agent
Issue 1778 : Passive scan AJAX spider requests
Issue 1790 : Move Buffer Overflow Scanner from Beta to Release
Issue 1793 : Allow active scan scripts to check if the scan was stopped
Issue 1795 : Allow JVM options to be configured via GUI
Issue 1799 : Minor Feature Request: Allow URL to be pasted into start Spider dialog.
Issue 1802 : Minor Enhancement: Change active Pause Button to a Play button
Issue 1849 : Option to merge related issues in reports
Issue 1857 : Libraries that were updated
Issue 1865 : Increase maximum db size

Bug fixes:

Issue 1760 : Unable to initialize home directory! xml/config.xml (No such file or directory)
Issue 1763 : Automatic check for updates fails to report new versions
Issue 1770 : Exceptions when calling (some) context API actions in daemon mode
Issue 1771 : For OSX the zap.sh in the core download hard-codes the relative java location
Issue 1772 : On OS X, Found Java version lies
Issue 1777 : “Cannot locate configuration source null.policy” after opening “Active Scan” dialogue
Issue 1781 : ZAP errors with “Unsupported option ‘-psn_x_xxxxxxx’” on OS X
Issue 1784 : NullPointerException when active scanning through the API with a target without scheme
Issue 1785 : Plugin enabled even if dependencies are not, “hangs” active scan
Issue 1787 : Context not used by the Spider even if selected
Issue 1788 : Scan Progress Pane Needs Sorting Change
Issue 1789 : Forced Browse/AJAX Spider messages not restored to Sites tab
Issue 1792 : Report not generated in daemon mode
Issue 1798 : Stop Attack Feature Locks up ZAP?
Issue 1804 : Disable processing of XML external entities by default
Issue 1805 : ZAP API might not return the response in requested format on errors
Issue 1858 : Spider might report wrong progress after finishing
Issue 1872 : EDT accessed in daemon mode


	Introduction	the introduction to ZAP
	Releases	the full set of releases
	Credits	the people and groups who have made this release possible

Release 2.4.1

Mon, 01 Jan 0001 00:00:00 +0000

Release 2.4.1

This release includes important security fixes - users are urged to upgrade asap.

One of the changes means that an API key is created by default, which means that any applications using the ZAP API will fail unless they are updated to use that key.

The API Key can be found in the API Options screen

Release 2.4.0

Mon, 01 Jan 0001 00:00:00 +0000

Release 2.4.0

The following changes were made in this release:

Significant changes:

Attack mode

A new ‘ATTACK’ Mode has been added - new nodes that are in Scope are actively scanned as soon as they are discovered.

Release 2.3.1

Mon, 01 Jan 0001 00:00:00 +0000

Release 2.3.1

The following changes were made in this release:

Issue 81 : ZAP changes request data (while switching views)
Issue 377 : Unfulfilled dependencies hang the active scan
Issue 1073 : Cant remove scripts marked as ’load on start'
Issue 1114 : core.newSession doesn’t clear Sites
Issue 1155 : Historical Request Tab Doesn’t allow formatting changes
Issue 1156 : Proxy gzip decoder doesn’t update content length in response headers
Issue 1163 : Unable to set a home directory with a space on the command line
Issue 1166 : Redundant indexes in zapdb.script
Issue 1168 : Add proxy support for “deflate” content encoding
Issue 1170 : Spider Context/User pop up menus no longer shown
Issue 1179 : Unable to select 2 requests in fuzz results (Ctrl + click)
Issue 1181 : Vulnerable pages active scanned only once
Issue 1182 : Alerts of same type for different parameters of same vulnerable page shown only once in “Alerts” tree
Issue 1183 : NullPointerException while selecting a node in the “Alerts” tab after deleting a message
Issue 1191 : Cmdline session params have no effect
Issue 1193 : Scan URL path elements - turn off by default
Issue 1194 : Command line arguments are not passed to extensions when starting ZAP in daemon mode
Issue 1196 : AbstractPlugin.bingo incorrectly sets evidence to attack
Issue 1202 : Issue with loading addons that did not initialize correctly
Issue 1203 : Wordpress Authentication Script
Issue 1206 : “History” tab is not cleared when a new session is created through the API with ZAP in GUI mode


	Introduction	the introduction to ZAP
	Releases	the full set of releases
	Credits	the people and groups who have made this release possible

Release 2.3.0

Mon, 01 Jan 0001 00:00:00 +0000

Release 2.3.0

The following changes were made in this release:

Significant changes:

ZAP ‘lite’ version

For this release we are providing a ‘lite’ version of ZAP in addition to the ‘full’ version. This contains exactly the same core code, but it just includes fewer default add-ons. Of course, you can download all of the ‘missing’ add-ons from the ZAP marketplace to ‘upgrade’ the lite version to a full one.
The ‘lite’ version is aimed at people new to security who need less initial functionality which will hopefully be easier to get started with. It will also be suitable for people looking for a smaller download or those wishing to customize exactly which add-ons they install.

Release 2.2.2

Mon, 01 Jan 0001 00:00:00 +0000

Release 2.2.2

The following changes were made in this release:

Minor changes:

Issue 744 : Allow overwriting custom fuzz files

Issue 795 : Allow param types scanned to be configured via UI

Issue 797 : Limit number of ascan results listed to speed up scans

Issue 798 : Add example scripts

Bug Fixes:

Issue 656 : Content-length: 0 in GET requests

Issue 680 : Set the right content type for JSON API results

Issue 716 : ZAP flags its own HTTP responses

Issue 746 : PassiveScan Extension Crashes if the History Extension is disabled

Issue 747 : Error opening session files on directories with special characters

Issue 791 : Saved sessions are discarded on ZAP’s exit

Issue 792 : Diff dialog fails when invoked from Zest

Issue 794 : Malformed Byte Sequence Exception

Issue 800 : User not prompted with check-for-updates option

Issue 802 : XML report generated by API differs from GUI report


	Introduction	the introduction to ZAP
	Releases	the full set of releases
	Credits	the people and groups who have made this release possible

Release 2.2.1

Mon, 01 Jan 0001 00:00:00 +0000

Release 2.2.1

The following changes were made in this release:

Bug Fixes:

Issue 789 : Scripting broken on Windows


	Introduction	the introduction to ZAP
	Releases	the full set of releases
	Credits	the people and groups who have made this release possible

Release 2.2.0

Mon, 01 Jan 0001 00:00:00 +0000

Release 2.2.0

The following changes were made in this release:

Major changes:

Issue 717 : Scripts: support multiple scripts and embedding within ZAP components

Support for Mozilla Zest: https://developer.mozilla.org/en-US/docs/Zest

Support for Mozilla Plug-n-Hack: https://developer.mozilla.org/en-US/docs/Plug-n-Hack

Support for scanning headers as well as JSON and XML formats

Minor changes:

Issue 711 : Support scanning of XML requests

Issue 713 : Add CWE and WASC numbers to issues

Issue 719 : Custom http breakpoints with more options

Issue 738 : Options to hide tabs / windows

Issue 750 : Upgrade script console to support non textbased scripting languages

Issue 752 : Create a new root CA when first run

Issue 775 : Allow host to be set via the command line

Bug Fixes:

Issue 555 : Http panels default to hex view

Issue 599 : The save session api does not allow to overwrite session already has same name

Issue 630 : URLCanonicalizer.getCanonicalURL produces URIs “half” decoded

Issue 631 : URLCanonicalizer.buildCleanedParametersURIRepresentation returns URIs in percent-encoded form and decoded

Issue 652 : Shutdown after a big scan takes too long (deleting ascan records)

Issue 655 : API encoding issues

Issue 665 : NullPointerException while proxying with a URI with an empty path component

Issue 666 : JSONException while calling an API action without the required parameter(s)

Issue 669 : Certificate algorithm constraints in Java 1.7

Issue 674 : Add HttpSessionAPI to ApiGeneratorUtils

Issue 685 : Add dummy file to “fuzzers” directory

Issue 686 : Log HttpException (as error) in the ProxyThread

Issue 687 : Change HTTP response header parser to be less strict

Issue 690 : Context Authentication URLs don’t fail manual overwriting.

Issue 691 : Handle old plugins

Issue 692 : Report the version of java found by zap.sh

Issue 693 : Command line should show all options

Issue 694 : API UI fails on IE

Issue 695 : Sites tree doesnt clear on new session created by API

Issue 696 : Change “Ajax Spider” add-on options to use ZapNumberSpinner

Issue 697 : API action “proxy.pac” might return wrong domain/port

Issue 698 : Passive Scanner API view “recordsToScan” returns -1 after finish scanning the messages

Issue 699 : Fix HTML errors in the help pages

Issue 702 : Do not load newer add-on versions if they are not targeted for the running ZAP version

Issue 703 : Add-on ZAP version constraints “not-before-version” and “not-from-version” are not respected for already “installed” add-ons

Issue 706 : ZAP API doesn’t parse correctly query parameters with “&” characters

Issue 710 : URLCanonicalizer.getCanonicalURL fails to correctly parse query parameters with “&” and “=” characters

Issue 712 : HttpSessions API action “setSessionTokenValue” should add the session token name to the site’s session tokens

Issue 720 : Cannot send non standard http methods

Issue 721 : Non POST and PUT requests receive a 504 when server expects a request body

Issue 724 : Do not clone the alert’s message that will be shown in message panels

Issue 725 : Clear alert’s panel fields

Issue 726 : Catch active scanner variants’ exceptions

Issue 727 : Name of automatically created HTTP sessions is always in English

Issue 728 : Allow to create a session with a given name through the HttpSessions API

Issue 729 : Update NTLM authentication code

Issue 730 : MissingResourceException while selecting a disabled extension (from an add-on) in the “Extensions” options panel

Issue 731 : MissingResourceException with ExtensionFuzz enabled and ExtensionBruteForce disabled

Issue 736 : Change add-on class loading strategy to parent-last

Issue 737 : Restore “Ajax spider” add-on dependencies

Issue 756 : Allow Context Panels intercommunication

Issue 763 : XML report empty when used in daemon mode

Issue 764 : HTTP fuzz results dont support right click menus

Issue 766 : Searching fuzz results doesnt include the header

Issue 767 : HTTP Session API could be less strict

Issue 772 : Restructuring of Saving/Loading Context Data

Issue 774 : Build doesnt include scripts directory

Issue 776 : Allow add-ons to warn user if they’re closing ZAP with unsaved resources open

Issue 777 : Unable to cancel changes when using Include in/Exclude from Context

Issue 782 : NoSuchMethodError when excluding a WebSocket channel URL from context

Issue 785 : Change zap.sh to cope with Java 1.8


	Introduction	the introduction to ZAP
	Releases	the full set of releases
	Credits	the people and groups who have made this release possible

Release 2.1.0

Mon, 01 Jan 0001 00:00:00 +0000

Release 2.1.0

The following changes were made in this release:

Minor changes:

Issue 355: Allow Positional Fuzzing

Issue 484: Check java version in zap.sh

Issue 496: Allow to see the request and response at the same time in the main window

Issue 505: Http Session API Implementation

Issue 515: Change add-ons to make use of automatic load of messages

Issue 516: Change add-ons messages keys to have unique prefix

Issue 518: Add OData support

Issue 537: Option to Force Browse files/resources with user-defined extensions

Issue 538: Allow non sequential lines to be selected in the history log

Issue 542: browse api - prompt window to enable

Issue 551: Add csrfmiddlewaretoken to list of default Anti csrf tokens

Issue 552: Make ZapPortNumberSpinner a subclass of ZapNumberSpinner

Issue 553: Add option to filter alerts by scope

Issue 561: Copy URLs right click option

Issue 566: Abstract class for creating generic popups

Issue 568: Allow extensions to run from the command line

Issue 569: Allow Spider Scan to start without prior visit

Issue 587: Upgrade to JBroFuzz 2.5

Issue 597: Shown “Author” field on available add-ons (“Marketplace” tab)

Issue 602: Allow to (explicitly) choose the file type when exporting URLs to file

Issue 605: Force intercepts via header

Issue 621: Handle requests to the proxy URL (and generate a PAC file)

Issue 638: Persist and snapshot sessions instead of saving them

Bug Fixes:

Issue 150: java.io.IOException at org.owasp.jbrofuzz.system.Logger.checkOrCreateDirs

Issue 317: Move (or protect) the ‘Bin’ button

Issue 452: API - shutdown asynchronously

Issue 488: Fuzz categories available for the default category not updated after installing/uninstalling an add-on (with fuzz files)

Issue 490: Re-authentication only works with the active scanner

Issue 499: NullPointerException while uninstalling an add-on with a manual request editor

Issue 500: NullPointerException while uninstalling an add-on manually installed

Issue 501: ExtensionFactory keeps references to uninstalled add-ons (with extensions)

Issue 502: Manually installed add-ons don’t remain installed

Issue 504: Table of installed add-ons may not update after manually installing an add-on

Issue 507: Quick start tab doesnt have a scroll pane

Issue 508: Some add-ons are not unloading all its components when uninstalled

Issue 509: Remove add-on ResourceBundle when an add-on is uninstalled

Issue 510: Remove add-on HelpSet when an add-on is uninstalled

Issue 517: Add-ons are added to “main” class loader when installed

Issue 520: MissingResourceException when generating “Alerts” report

Issue 524: Host authentication is used even when disabled

Issue 525: “Report / Export all URLs to File …” fails

Issue 528: Scan progress dialog can show negative progress times

Issue 533: Default ports 80 and 443 are appended to sites in site tree

Issue 540: Maximised work tabs hidden when response tab position changed

Issue 548: Diff messages are appended to the “Diff” dialogue

Issue 550: Fuzzer - Buffer Overflow stops because of java.sql.SQLDataException: data exception: string data, right truncation

Issue 558: Auto tagging broken

Issue 564: Active scanner can hang if dependencies used

Issue 565: Marketplace: Downloads won’t use configured upstream Proxy

Issue 567: Spelling mistake

Issue 574: Spider fails when invoked via the API

Issue 579: Some (build) targets are incorrectly relying on the platform default encoding

Issue 582: NullPointerException while opening a session in daemon mode

Issue 583: NullPointerException while managing a session in daemon mode with “WebSockets” add-on installed

Issue 588: ExtensionHistory.historyIdToRef should be cleared when changing session

Issue 593: Quick Start may start the active scan before waiting for the spider to finish

Issue 614: SessionFixation labels wrong

Issue 616: Spider handles incorrectly form actions containing fragments (#)

Issue 617: NullPointerException when spidering a context

Issue 622: Local proxy unable to correctly detect requests to itself

Issue 626: Scroll bar of alert text areas is always at the bottom

Issue 627: Allow add-ons to remove main tool bar buttons/separators

Issue 628: Allow add-ons to remove the registered API

Issue 632: Manual Request Editor dialogue (HTTP) configurations not saved correctly

Issue 633: Auto tag scanners are shown in passive scanners table

Issue 634: Empty passive scanner shown in the passive scanners table


	Introduction	the introduction to ZAP
	Releases	the full set of releases
	Credits	the people and groups who have made this release possible

Release 2.0.0

Mon, 01 Jan 0001 00:00:00 +0000

Release 2.0.0

The following changes were made in this release:

Significant changes:

An integrated add-ons marketplace

ZAP can be extended by add-ons that have full access to all of the ZAP internals. Anyone can write add-ons and upload them to the ZAP Add-on Marketplace (OK, so its a Google code project called zap-extensions, but you get the idea).
More importantly you can now browse, download and install those add-ons from within ZAP. Most add-ons can be dynamically installed (and uninstalled) so you wont even need a restart.
You can choose to be notified of updates, and even be automatically updated. And as the scan rules are now implemented as add-ons you can get the latest rules as soon as they are published.

Release 1.4.1

Mon, 01 Jan 0001 00:00:00 +0000

Release 1.4.1

The following changes were made in this release:

Bug fixes:

Issue 185: Problem causes Undoing/Redoing in text fields other than the one that has the focus.

Issue 297: Exclusions not honored

Issue 298: Content-Length header is not properly update

Issue 306: Change zap.sh memory setting

Issue 307: ConcurrentModificationException when openning a big session

Issue 308: ZAP in daemon mode exits when you save a session

Issue 309: Client API cant cope with Informational risk

Issue 312: Increase the maximum number of scanning threads allowed

Issue 314: Handle very large results more cleanly

Issue 315: XSS false positive - injecting into an input src when the type is not ‘image’

Issue 319: Spider progress not reported correctly via the API

Issue 320: AScan can miss subtrees if invoked via the API

Issue 337: Increase jvm permsize


	Introduction	the introduction to ZAP
	Releases	the full set of releases
	Credits	the people and groups who have made this release possible

Release 1.4.0

Mon, 01 Jan 0001 00:00:00 +0000

Release 1.4.0

The following changes were made in this release:

Significant changes:

Issue 133: Add Syntax highlighting to Response Panel

The HTML panels now support switchable syntax highlighting.

Release 1.3.4

Mon, 01 Jan 0001 00:00:00 +0000

Release 1.3.4

The following changes were made in this release:

Minor changes:

Issue 146: Inverse regex on search plus fuzz match highlighting

Issue 202: Option to turn off brute force recursion

Issue 215: Allow custom brute force files to be added easily

Also added the ability to set the default brute force file.

Release 1.3.3

Mon, 01 Jan 0001 00:00:00 +0000

Release 1.3.3

The following changes were made in this release:

Bug fixes:

Issue 156: ZAP active scanner freezes against DVWA

Issue 157: Alert edit/save broken

Issue 161: Reporting does not work when not specifying the extension in the report’s name (on Linux)


	Introduction	the introduction to ZAP
	Releases	the full set of releases
	Credits	the people and groups who have made this release possible

Release 1.3.2

Mon, 01 Jan 0001 00:00:00 +0000

Release 1.3.2

The following changes were made in this release:

Bug fixes:

Issue 53: Scan Policy configuration bug

Issue 62: The “Export all urls to File” does not seem to work

Issue 87: SSL not working with Dynamic SSL Certificate generator (with Chrome on Mac OS)

Issue 95: NullPointerException when dropping requests in proxy

Issue 106: Cannot display HTTP gzipped contents

Issue 107: The last intercepted request/response remains in the Break window

Issue 131: Right click on Mac without mouse doesn’t work

Issue 138: Broken end of stream detection causes endless loop and threads not ending

Issue 143: Help button: Options –> Language

Issue 145: Crash at start up

Issue 147: Session save and request/response data

Issue 151: Incorrect language used by ZAP

Issue 152: Check for updates not working


	Introduction	the introduction to ZAP
	Releases	the full set of releases
	Credits	the people and groups who have made this release possible

Release 1.3.1

Mon, 01 Jan 0001 00:00:00 +0000

Release 1.3.1

The following changes were made in this release:

Bug fixes:

Issue 97: Working Directory for Applications

Issue 98: Not possible to cancel check for updates

Issue 100: Alerts tab has 2 ‘Resend…’ right click popups

Issue 104: Display warning dialog, when no root CA certificate exists

Issue 110: Choosing user’s language by default, when starting the first time

Issue 112: Provide a way to apply language packs on Mac OS

Issue 121: Session compare report javascript broken in Firefox 3

Issue 123: Cant select https site from Active scan window if theres an http equivalent

Issue 127: CSRF token feature does not work in fuzz - added help explanation for partial fix

Issue 140: The Display options shouldnt include the advanced or windows manager options

SSL Bug which prevented SSL connections from being established in any browser

Known issues:

Mac OS X: Dynamic SSL and Google Chrome

Currently Dynamic SSL is not working when using Google Chrome. This is because of an unresolved known issue with Google Chrome and Mac OS X Keychain. When importing OWASP ZAP’s Root CA into the keychain and requesting a SSL website, an “Invalid certificate” error message is shown.

Release 1.3.0

Mon, 01 Jan 0001 00:00:00 +0000

Release 1.3.0

The following changes were made in this release:

Significant changes:

Fuzzing

Strings in a response can now be fuzzed to try to find vulnerabilities.
Anti CRSF tokens can be detected and automatically regenerated when fuzzing.
This functionality is based on code from the OWASP JBroFuzz project.

Release 1.2.0

Mon, 01 Jan 0001 00:00:00 +0000

Release 1.2.0

The following changes were made in this release:

Significant changes:

Memory Leaks

Memory leaks have been fixed in the active scanner and spider.

Release 1.1.0

Mon, 01 Jan 0001 00:00:00 +0000

Release 1.1.0

The following changes were made in this release:

Significant changes:

OWASP rebranding

ZAP has been accepted as an OWASP project.
Its homepage is now: https://wiki.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project

Release 1.0.0

Mon, 01 Jan 0001 00:00:00 +0000

Release 1.0.0

The following changes were made in this release:

Significant changes:

Help screens

Help screens have been added for all of the functionality now provided by ZAP.
Context sensitive help has also been implemented so that when you press the F1 key then the help screen associated with the tab you have selected will be displayed.

Releases on ZAP

Release 2.17.0

Release 2.17.0

Alert De-duplication

Release 2.16.1

Release 2.16.1

Release 2.16.0

Release 2.16.0

Release 2.15.0

Release 2.15.0

Scripts as First Class Scan Rules

Release 2.14.0

Release 2.14.0

Rebranding and Docker Hub Move

Release 2.13.0

Release 2.13.0

HTTP/2 Support

Release 2.12.0

Release 2.12.0

Release 2.11.1

Release 2.11.1

Changes in Bundled Libraries

Release 2.11.0

Release 2.11.0

Release 2.10.0

Release 2.10.0

Release 2.9.0

Release 2.9.0

Release 2.8.0

Release 2.8.0

Release 2.7.0

Release 2.7.0

Release 2.6.0

Release 2.6.0

Release 2.5.0

Release 2.5.0

ZAP API Changes:

VIEW authorization / getAuthorizationDetectionMethod

Release 2.4.3

Release 2.4.3

Enhancements:

Bug fixes:

See also

Release 2.4.2

Release 2.4.2

Enhancements:

Bug fixes:

See also

Release 2.4.1

Release 2.4.1

Release 2.4.0

Release 2.4.0

Significant changes:

Attack mode

Release 2.3.1

Release 2.3.1

See also

Release 2.3.0

Release 2.3.0

Significant changes:

ZAP ‘lite’ version

Release 2.2.2

Release 2.2.2

Minor changes:

Issue 744 : Allow overwriting custom fuzz files

Issue 795 : Allow param types scanned to be configured via UI

Issue 797 : Limit number of ascan results listed to speed up scans

Issue 798 : Add example scripts

Bug Fixes:

Issue 656 : Content-length: 0 in GET requests

Issue 680 : Set the right content type for JSON API results

Issue 716 : ZAP flags its own HTTP responses

Issue 746 : PassiveScan Extension Crashes if the History Extension is disabled

Issue 747 : Error opening session files on directories with special characters

Issue 791 : Saved sessions are discarded on ZAP’s exit

Issue 792 : Diff dialog fails when invoked from Zest

Issue 794 : Malformed Byte Sequence Exception

Issue 800 : User not prompted with check-for-updates option

Issue 802 : XML report generated by API differs from GUI report

See also