Fuzz and Access Control Jobs in Automation file.

9 views
Skip to first unread message

Mhdhar

unread,
Aug 1, 2026, 4:03:09 PM (3 days ago) Aug 1
to ZAP User Group
Hey Simon,
Is it possible to use Fuzz job and access control jobs in Automation file.
Command:
ubuntu@ubuntu:~/vapt-reports/workspace-default/owasp/zap-auth-web-local-scan$ sudo docker run --rm -m 14g --cpus="4" \
  -e JAVA_OPTS="-Xms512m -Xmx8g" \
  -p 38073:8080 \
  --mount type=bind,src=$(pwd),dst=/zap/wrk \
  --mount type=bind,src=$(pwd),dst=/zap/reports \
  --mount type=bind,src=$(pwd)/.tmp,dst=/home/zap/.ZAP \
  -t zaproxy/zap-stable zap.sh -cmd \
  -autorun /zap/wrk/automation.yaml
Found Java version 17.0.19
Available memory: 15988 MB
Using JVM args: -Xmx3997m
Aug 01, 2026 7:52:21 PM java.util.prefs.FileSystemPreferences$1 run
INFO: Created user preferences directory.
Job passiveScan-config set disableAllRules = false
Job spider set user = zap-user
Job spider set context = ZAP-Context-1785613375461
Job spider set maxDepth = 5
Job spider set maxChildren = 25
Job spider set maxDuration = 2
Job ajaxSpider set context = ZAP-Context-1785613375461
Job ajaxSpider set user = zap-user
Job ajaxSpider set maxDuration = 2
Unrecognised job type: accessControl
Unrecognised job type: fuzz
Unrecognised job type: fuzz
Job activeScan set context = ZAP-Context-1785613375461
Job activeScan set user = zap-user
Job activeScan set maxRuleDurationInMins = 2
Job activeScan set maxScanDurationInMins = 1
Job activeScan set maxAlertsPerRule = 5
Job json-report set template = traditional-json
Job json-report set reportDir = /zap/reports
Job json-report set reportTitle = ZAP Authenticated Report as JSON
Job auth-json-report set template = auth-report-json
Job auth-json-report set reportDir = /zap/reports
Job auth-json-report set reportTitle = ZAP Authenticated Report as JSON
Job auth-json-report set reportFile = auth-report.json
Job html-report set template = traditional-html
Job html-report set reportDir = /zap/reports
Job html-report set reportTitle = ZAP Authenticated Report as html
Automation plan failures:
        Unrecognised job type: accessControl
        Unrecognised job type: fuzz
        Unrecognised job type: fuzz
ubuntu@ubuntu:~/vapt-

Error: 
Automation plan failures:
        Unrecognised job type: accessControl
        Unrecognised job type: fuzz
        Unrecognised job type: fuzz

----

My automation file.
env:
vars:
hosts: &ref_0
contexts:
- name: ZAP-Context-1785613375461
urls: *ref_0
includePaths:
- http://36.50.82.120:3000.*
excludePaths:
- .*\.png
- .*\.css
- .*\.jpg
- .*\.woff2
authentication:
method: browser
parameters:
browserId: firefox-headless
loginPageWait: 30
verification:
method: poll
loggedInRegex: admin@juice-sh\.op
loggedOutRegex: (Invalid email or password\.)|(Invalid credentials)
pollFrequency: 10
pollUnits: seconds
sessionManagement:
method: autodetect
users:
- name: zap-user
credentials:
username: ad...@juice-sh.op
password: admin123
parameters:
failOnError: true
failOnWarning: false
progressToStdout: true
continueOnFailure: false
jobs:
- type: passiveScan-config
parameters:
disableAllRules: false
rules:
- name: Authentication Request Identified
id: 10111
threshold: medium
- name: Session Management Response Identified
id: 10112
threshold: medium
- name: Verification Request Identified
id: 10113
threshold: medium
- id: 10027
threshold: 'off'
- id: 10099
threshold: 'off'
- id: 10057
threshold: 'off'
- name: spider
type: spider
parameters:
user: zap-user
context: ZAP-Context-1785613375461
maxDepth: 5
maxChildren: 25
maxDuration: 2
- name: ajaxSpider
type: spiderAjax
parameters:
context: ZAP-Context-1785613375461
user: zap-user
maxDuration: 2

- name: requestor
type: requestor
parameters:
user: zap-user
requests:
method: GET
method: GET
method: GET
method: GET
method: GET
method: GET
method: GET
method: GET
method: GET
method: GET
method: GET
method: GET
method: GET
method: GET
method: GET
method: GET
method: GET
method: GET
method: GET
method: GET
method: GET
method: GET
method: GET
method: GET
method: GET
method: GET
method: GET
method: GET
method: GET
method: GET
method: GET
method: GET
method: GET
method: GET
method: GET
method: GET
method: GET
method: GET
- name: accessControl-unauth
type: accessControl
parameters:
context: ZAP-Context-1785613375461
scanAsUnAuthUser: true
numberOfThreads: 2
raiseAlert: true
- name: idor-fuzz
type: fuzz
parameters:
user: zap-user
fuzzerConfig:
maxErrorsAllowed: 10
numMessagesPerSecond: 5
messageFuzzers:
- type: http-message-fuzzer
parameters:
method: POST
data: '{"couponData":"bnVsbA==","orderDetails":{"paymentId":"3","addressId":"FUZZ","deliveryMethodId":"1"}}'
headers: *ref_2
payloads:
- type: numberzz
parameters:
start: 0
end: 507
increment: 1
- type: http-message-fuzzer
parameters:
method: DELETE
payloads:
- type: numberzz
parameters:
start: 0
end: 507
increment: 1
- type: http-message-fuzzer
parameters:
method: DELETE
payloads:
- type: numberzz
parameters:
start: 0
end: 503
increment: 1
- name: validation-fuzz
type: fuzz
parameters:
user: zap-user
fuzzerConfig:
maxErrorsAllowed: 20
numMessagesPerSecond: 5
messageFuzzers:
- type: http-message-fuzzer
parameters:
method: PUT
data: '{"message":"FUZZ","author":"ad...@juice-sh.op"}'
headers:
Content-Type: application/json
payloads:
- &ref_3
type: file
parameters:
file: /zap/wrk/fuzz-files/validation-master.txt
- type: http-message-fuzzer
parameters:
method: PUT
data: '{"message":"helloworld","author":"FUZZ"}'
headers:
Content-Type: application/json
payloads:
- *ref_3
- type: http-message-fuzzer
parameters:
method: POST
data: '{"ProductId":24,"BasketId":"1","quantity":"FUZZ"}'
headers:
Content-Type: application/json
payloads:
- *ref_3
- type: http-message-fuzzer
parameters:
method: GET
payloads:
- *ref_3
- name: activeScan
type: activeScan
parameters:
context: ZAP-Context-1785613375461
user: zap-user
maxRuleDurationInMins: 2
maxScanDurationInMins: 1
maxAlertsPerRule: 5
- name: passiveScan-wait
type: passiveScan-wait
- name: json-report
type: report
parameters:
template: traditional-json
reportDir: /zap/reports
reportTitle: ZAP Authenticated Report as JSON
- name: html-report
type: report
parameters:
template: traditional-html
reportDir: /zap/reports
reportTitle: ZAP Authenticated Report as html

Sai Mahidhar

unread,
Aug 1, 2026, 4:38:46 PM (3 days ago) Aug 1
to zaprox...@googlegroups.com
My bad looks like automation doesnt support access control and fuzzing. They are available only in GUI framework or run zap in daemon mode and invoke via api. 

Simon correct me if i am wrong.

--
ZAP by Checkmarx: https://www.zaproxy.org/
---
You received this message because you are subscribed to the Google Groups "ZAP User Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to zaproxy-user...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/zaproxy-users/fda254a6-d637-4ff5-8635-1d75675e61dan%40googlegroups.com.
Reply all
Reply to author
Forward
0 new messages