Getting Started on ZAP

Configuring Proxies

Mon, 01 Jan 0001 00:00:00 +0000

Configuring Proxies

The best way to use a browser with ZAP is to launch it from ZAP. It will then be automatically configured to proxy through ZAP and to ignore certificate warnings.

If for any reason you are unable or unwilling to do that then you will need to configure your browser to use ZAP as a proxy.

Scanner Rules

Mon, 01 Jan 0001 00:00:00 +0000

Scanner Rules

ZAP supports both active and passive scanning rules.

All rules are contained in add-ons so that they can be updated quickly and easily.

By default ZAP ships with just the ‘Release’ status rules, but you can install ‘Beta’ and ‘Alpha’ status rules via the Manage Add-ons dialog.

Scan Policies define which rules run and how they run.

A Basic Penetration Test

Mon, 01 Jan 0001 00:00:00 +0000

A Basic Penetration Test

A basic penetration test is made up of the following steps:

Explore

Use your browser to explore all of the functionality provided by the application.
Follow all links, press all buttons and fill in and submit all forms.
If the applications supports multiple roles then do this for each of the roles.
For each role save the ZAP session in a different file and start a new session before you start using the next role.