Hacking on ZAP

ZAP Contributor License Agreement

Tue, 23 Jan 2024 00:00:00 +0000

We are introducing a Contributor License Agreement to cover all ZAP contributions.

Community - Tips and Tricks

Fri, 25 Aug 2023 00:00:00 +0000

News about a community area to contribute ZAP usage tips and tricks.

Hacking ZAP - ZAP Extender Scripts

Tue, 13 Sep 2022 00:00:00 +0000

An overview of ZAP Extender scripts with examples. Use ZAP as a web server, subscribe to internal ZAP events, and more!

Hacking ZAP #4 - Active scan rules

Wed, 30 Apr 2014 00:00:00 +0000

Welcome to a series of blog posts aimed at helping you “hack the ZAP source code”.
The previous post in this series is: Hacking ZAP #3 - Passive scan rules

Active scan rules are another relatively simple way to enhance ZAP. Active scan rules attack the server, and therefore are only run when explicitly invoked by the user. You should only use active scan rules against applications that you have permission to attack.
You can also write active scan rules dynamically using scripts, as we will see later in this series, but even then it’s very useful to understand some of the concepts underlying classes available to you.

Hacking ZAP #3 - Passive scan rules

Thu, 03 Apr 2014 00:00:00 +0000

Welcome to a series of blog posts aimed at helping you “hack the ZAP source code”.
The previous post in this series is: Hacking ZAP #2 - Getting Started

One of the easiest ways to enhance ZAP is to write new passive scan rules.
Passive scan rules are used to warn the user of potential vulnerabilities that can be detected passively - they are not allowed to make any new requests or manipulate the requests or responses in any way.
They typically run against all of the requests and responses that flow through ZAP.
Passive rules run in separate background thread so that they have as little effect on performance as possible.

Hacking ZAP #2 - Getting Started

Thu, 20 Mar 2014 00:00:00 +0000

Welcome to a series of blog posts aimed at helping you “hack the ZAP source code”.
The previous post in this series is: Hacking ZAP #1 - Why should you?

In order to change the ZAP source code you will need to set up a development environment.

Requirements

The following software is used/required to obtain and build ZAP (core) and the add-ons:

Hacking ZAP #1 - Why should you?

Mon, 10 Mar 2014 00:00:00 +0000

Welcome to a series of blog posts aimed at helping you “hack the ZAP source code”.

ZAP is an open source tool for finding vulnerabilities in web applications. It is the most active OWASP project and is very community focused - it probably has more contributors than any other web application security tool. It is being continually enhanced and, unusually for a security tool, has been translated into over 25 languages thanks to over 70 translators.
This series is designed to help newcomers dive head-first into the ZAP source code. However for this first blog post I thought I’d take a step back and give some reasons why you might want to change the ZAP source code in the first place.