Options dialog on ZAP

Options Active Scan screen

Mon, 01 Jan 0001 00:00:00 +0000

Options Active Scan screen

This screen allows you to configure the active scan options:

Number of Hosts Scanned Concurrently

The maximum number of hosts that will be scanned at the same time.

Options Active Scan Input Vectors screen

Mon, 01 Jan 0001 00:00:00 +0000

Options Active Scan Input Vectors screen

This screen allows you to configure the active scan input vectors.

These are the elements that the active scanner will attack.

Scanning all of the elements supported will take longer, but not scanning some elements may cause some vulnerabilities to be missed.

Injectable Targets

The request elements that the active scanner will target:

Options Alerts screen

Mon, 01 Jan 0001 00:00:00 +0000

Options Alerts screen

This screen allows you to configure the alerts options:

If selected then related issues will be merged in any reports generated.
This will significantly reduce the size of the report as duplicated information will be removed.

Options Anti CRSF screen

Mon, 01 Jan 0001 00:00:00 +0000

Options Anti CRSF Tokens screen

This screen allows you to configure the anti CSRF tokens options:

Tokens

The form POST parameter names that should be treated as anti CSRF tokens.

Options API screen

Mon, 01 Jan 0001 00:00:00 +0000

Options API screen

This screen allows you to configure the API options:

Enabled

If enabled then the API is available to all machines that are able to access ZAP’s proxies that expose the API.

Options Breakpoints screen

Mon, 01 Jan 0001 00:00:00 +0000

Options Breakpoints screen

This screen allows you to configure the breakpoint options:

Confirm drop trapped message

Asks for confirmation when a request or response is dropped.

Options Callback Address screen

Mon, 01 Jan 0001 00:00:00 +0000

Options Callback Address screen

The Callback Address screen allows you to configure the address used to detect vulnerabilities that allow an attacker to call remote URLs.
In previous versions the ZAP API was used for this purpose, but from 2.6.0 onwards a separate endpoint is used so that target systems no longer need access to the API.

Options Check for Updates screen

Mon, 01 Jan 0001 00:00:00 +0000

Options Check for Updates screen

This screen allows you to configure whether ZAP checks to see if you are running the latest version when it starts, and if so what it does.

Check for Updates on startup

If selected then ZAP will automatically check for updates to the whole application and all of the add-ons when it starts.

Options Client Certificate screen

Mon, 01 Jan 0001 00:00:00 +0000

This page was moved.

Options Database screen

Mon, 01 Jan 0001 00:00:00 +0000

Options Database screen

This screen allows you to configure the database options:

Compact (on exit)

Allows to compact the database when ZAP is closed, compacting the database ensures a minimal space disk usage but it will also take longer to exit ZAP.

Options Connection screen

Mon, 01 Jan 0001 00:00:00 +0000

This page was moved.

Options Display screen

Mon, 01 Jan 0001 00:00:00 +0000

Options Display screen

The Display screen allows you to configure:

Images

If ZAP processes images.

Show (local) CONNECT requests

If the HTTP CONNECT requests received by ZAP’s proxies should be persisted in the current session and shown in the History tab. The default is to not show those requests, they happen frequently (in preparation for TLS/SSL, WebSocket… connections) and, unless inspecting the behaviour of the client application, are not (usually) of much interest.

Options Extensions screen

Mon, 01 Jan 0001 00:00:00 +0000

Options Extensions screen

This screen allows you to enable/disable extensions that are available to ZAP, either core or added by add-ons.

Enable/Disable Extensions

Enabled extensions will be loaded by ZAP, thus adding the functionalities provided by those extensions. Disabled extensions will not be loaded.

Options Global Exclude URL screen

Mon, 01 Jan 0001 00:00:00 +0000

This page was moved.

Options HTTP Sessions screen

Mon, 01 Jan 0001 00:00:00 +0000

Options HTTP Sessions screen

This screen allows you to configure the HTTP Sessions Extension’s options:

Default Tokens

These are the names of the Cookies that are considered by default to be session tokens. As soon they are detected as parameters on a Site, they are automatically added as session tokens for that Site, unless manually overriden by user command.

Dynamic SSL Certificates

Mon, 01 Jan 0001 00:00:00 +0000

This page was moved.

Options JVM screen

Mon, 01 Jan 0001 00:00:00 +0000

Options JVM screen

This screen allows you to configure the JVM options used when starting ZAP.

JVM Options

A free format text field which will be added to the Java command line call when invoking ZAP via either zap.sh or zap.bat.

Options Keyboard screen

Mon, 01 Jan 0001 00:00:00 +0000

Options Keyboard screen

This screen allows you to configure keyboard shortcuts for all of the ZAP menus.

Clicking on any of the table rows will bring up a dialog box which allows you to change the keyboard shortcuts.

‘Action’ Cheatsheet

Clicking on this button will generate an HTML page which shows all of the keyboard shortcuts sorted by ‘action’.
This button is only enabled if the API is enabled and your operating systems supports opening URLs in a browser.

Options language screen

Mon, 01 Jan 0001 00:00:00 +0000

Options language screen

The language screen allows you to configure:

Language selection

The language ZAP uses for its display.
A set of languages are built into ZAP, however more languages may be available after the last release.
Check the ZAP download page for the latest language pack available.

Options Passive Scan Rules Screen

Mon, 01 Jan 0001 00:00:00 +0000

Options Passive Scan Rules Screen

This screen allows you to configure the passive scan rules.

Threshold

This controls how likely ZAP is to report potential vulnerabilities.

Options Rule Configuration screen

Mon, 01 Jan 0001 00:00:00 +0000

Options Rule Configuration screen

This screen allows you to configure the behaviour of specific active and passive scan rules.

Select any of the listed rows to see details of the specific configuration and to change the associated value. Both individual and all rules can be reset.

The built-in rules include:

Options Passive Scan Tags screen

Mon, 01 Jan 0001 00:00:00 +0000

Options Passive Scan Tags screen

This screen allows you to configure the tags that are added by the passive scanner. You can add, modify and remove the tags via the appropriate buttons.

Tag Interpolation

In order to allow some flexibility in Tag creation and content it is possible for the user to specify a regular expression with capturing groups which will be used to replace the group identifiers (ex: $1) in the resulting tag.

Options Scripts screen

Mon, 01 Jan 0001 00:00:00 +0000

Options Scripts screen

This screen allows you to configure the script options:

Enable scripts loaded from directories

If this option is selected then all of the scripts loaded from the specified directories will be enabled by default.

Options Passive Scanner Screen

Mon, 01 Jan 0001 00:00:00 +0000

Options Passive Scanner screen

This screen allows you to configure the passive scanner.

Configuration Options

Field	Details	Default	Config File
Only scan messages in scope	Sets whether or not the passive scan should be performed only on messages that are in scope.	Deselected	Key: `pscans.scanOnlyInScope` Values: `true` or `false`
Include traffic from the Fuzzer when passive scanning	Sets whether or not the passive scanning should be performed on messages generated by the Fuzzer.	Deselected	Key: `pscans.scanFuzzerMessages` Values: `true` or `false`
Max alerts any rule can raise	Sets the maximum number of alerts a passive scan rule should raise. This may be slightly exceeded due to threading. This setting is typically only useful for automated scanning. Scan rules that exceed this value will be disabled and will need to be manually enabled if a new session is started.	0 (unset)	Key: `pscans.maxAlertsPerRule` Values: `0`: unset or the maximum number of alerts
Max body size in bytes to scan	Sets the maximum size request or response body size in bytes that the passive scanner will scan. This can be used if passive scan rules take too long scanning very large requests or responses. If set the number of ignored requests and responses are recorded in the stats using the keys `stats.pscan.reqBodyTooBig` and `stats.pscan.respBodyTooBig` respectively.	0 (unset)	Key: `pscans.maxBodySizeInBytes` Values: `0`: unset or the maximum body size in bytes
Clear Queue	Empties the passive scan queue without passively scanning the messages. Currently running rules will run to completion but new rules will only be run when new messages are added to the queue.


	UI Overview	for an overview of the user interface
	Options dialogs	for details of the other Options dialog screens

Options Search screen

Mon, 01 Jan 0001 00:00:00 +0000

Options Search screen

This screen allows you to configure the search options:

Maximum results show in “Search” tab

Allows to set the number of maximum results that should be show in the Search tab.

Options Statistics screen

Mon, 01 Jan 0001 00:00:00 +0000

Options Statistics screen

This screen allows you to configure the statistics that ZAP maintains.

In Memory Statistics Enabled

By default ZAP maintains the statistics in memory. To disable the in memory statistics uncheck this box.

Options Local Proxies screen

Mon, 01 Jan 0001 00:00:00 +0000

This page was moved.

Options Spider screen

Mon, 01 Jan 0001 00:00:00 +0000

This page was moved.

Options dialog on ZAP

Options Active Scan screen

Options Active Scan screen

Number of Hosts Scanned Concurrently

Options Active Scan Input Vectors screen

Options Active Scan Input Vectors screen

Injectable Targets

Options Alerts screen

Options Alerts screen

Merge related alerts in report

Options Anti CRSF screen

Options Anti CRSF Tokens screen

Tokens

Options API screen

Options API screen

Enabled

Options Breakpoints screen

Options Breakpoints screen

Confirm drop trapped message

Options Callback Address screen

Options Callback Address screen

Options Check for Updates screen

Options Check for Updates screen

Check for Updates on startup

Options Client Certificate screen

Options Database screen

Options Database screen

Compact (on exit)

Options Connection screen

Options Display screen

Options Display screen

Images

Show (local) CONNECT requests

Options Extensions screen

Options Extensions screen

Enable/Disable Extensions

Options Global Exclude URL screen

Options HTTP Sessions screen

Options HTTP Sessions screen

Default Tokens

Dynamic SSL Certificates

Options JVM screen

Options JVM screen

JVM Options

Options Keyboard screen

Options Keyboard screen

‘Action’ Cheatsheet

Options language screen

Options language screen

Language selection

Options Passive Scan Rules Screen

Options Passive Scan Rules Screen

Threshold

Options Rule Configuration screen

Options Rule Configuration screen

Options Passive Scan Tags screen

Options Passive Scan Tags screen

Tag Interpolation

Options Scripts screen

Options Scripts screen

Enable scripts loaded from directories

Options Passive Scanner Screen

Options Passive Scanner screen

Configuration Options

See also

Options Search screen

Options Search screen

Maximum results show in “Search” tab

Options Statistics screen

Options Statistics screen

In Memory Statistics Enabled

Options Local Proxies screen

Options Spider screen