ZAP Scripts

Contact owners and managers

1–30 of 111

Welcome to the Zed Attack Proxy Scripts group.

This group is for sharing scripts that run in ZAP
For more information about ZAP scripts see the help page.

Please post scripts in a new topic with a title of the form: "Language / Type / Short description" eg "Java Script / Standalone / Find HTML comments".
Feel free to comment on scripts here (this is actively encouraged) but discussions about how to implement scripts should stay on the ZAP Developer Group.

Note that scripts run with the same permissions as the ZAP executable.
Malicious scripts will be removed as soon as we are aware of them but scripts you download from here (or anywhere else for that matter) are run at your own risk.

0 selected

Mirco Massone, Simon Bennetts2

Apr 11

Zap scan report generation from command line.

Hiya, Pro tip - dont use the Quick Start option if you want to do anything non trivial. The full set

unread,

Zap scan report generation from command line.

Hiya, Pro tip - dont use the Quick Start option if you want to do anything non trivial. The full set

Apr 11

pratik, Simon Bennetts2

Mar 15

Owasp Zap DAST through selenium scripts for authenticated testing and Github workflow

Hiya, See https://groups.google.com/g/zaproxy-users/c/NMSq85fuhu0/m/EloxavkRAQAJ - theres a new guide

unread,

Owasp Zap DAST through selenium scripts for authenticated testing and Github workflow

Hiya, See https://groups.google.com/g/zaproxy-users/c/NMSq85fuhu0/m/EloxavkRAQAJ - theres a new guide

Mar 15

Lax, … Simon Bennetts10

Feb 13

Zap Authentication through Zest Script

Hi Simon, The browser is a blank white screen, I just see that there is website URLs changing at the

unread,

Zap Authentication through Zest Script

Hi Simon, The browser is a blank white screen, I just see that there is website URLs changing at the

Feb 13

11/29/23

Due to the increase of SPAM on this group we have tweaked the group settings. These settings may take

unread,

Due to the increase of SPAM on this group we have tweaked the group settings. These settings may take

11/29/23

Taher Ben Abdallah

6/26/23

OWASP ZAP API capabilities

Hello, I wanted to ask about the capabilities of ZAP Python API, can it run targeted scripts or other

unread,

OWASP ZAP API capabilities

Hello, I wanted to ask about the capabilities of ZAP Python API, can it run targeted scripts or other

6/26/23

Arsalan Daneshfar, thc...@gmail.com3

6/13/23

zest gets disabled automatically

Thank you, I have replaced a python sender script and the Issue is solved. On Tuesday, June 13, 2023

unread,

zest gets disabled automatically

Thank you, I have replaced a python sender script and the Issue is solved. On Tuesday, June 13, 2023

6/13/23

Karthik Kanthaswamy, … Simon Bennetts8

3/12/23

Real time scan results to webhook

Hi Simon, I have finally figured out how to do it. Please pass it to whoever is in need :) # Import

unread,

Real time scan results to webhook

Hi Simon, I have finally figured out how to do it. Please pass it to whoever is in need :) # Import

3/12/23

Илья Романов, Simon Bennetts8

3/7/23

Scripts in autimation framework

By dir scanning I'm guessing you mean Froced Browsing? https://www.zaproxy.org/docs/desktop/

unread,

Scripts in autimation framework

By dir scanning I'm guessing you mean Froced Browsing? https://www.zaproxy.org/docs/desktop/

3/7/23

Ailton Caetano, … Simon Bennetts11

12/5/22

Referencing an Extender script

Many thanks! Simon On Sunday, 4 December 2022 at 23:47:34 UTC ailtonc...@gmail.com wrote: Here are

unread,

Referencing an Extender script

Many thanks! Simon On Sunday, 4 December 2022 at 23:47:34 UTC ailtonc...@gmail.com wrote: Here are

12/5/22

Shivani Rachakonda

7/18/22

Zap - run standalone script

Hi, I have few different XSS .zest scripts, which I have wrapped in one long .zest script via Add

unread,

Zap - run standalone script

Hi, I have few different XSS .zest scripts, which I have wrapped in one long .zest script via Add

7/18/22

zapper, thc...@gmail.com2

7/13/22

Unable to run Python Standalone Script

Hi. Currently the Python scripts can't be invoked from Zest scripts (invoking JavaScript scripts

unread,

Unable to run Python Standalone Script

Hi. Currently the Python scripts can't be invoked from Zest scripts (invoking JavaScript scripts

7/13/22

Shubham Patel, … Ailton Caetano5

3/3/22

ZAP Scripts Limitation

Hi Shubam, Take a look into the window creation template (https://github.com/zaproxy/community-

unread,

ZAP Scripts Limitation

Hi Shubam, Take a look into the window creation template (https://github.com/zaproxy/community-

3/3/22

Shubham Patel, Simon Bennetts5

3/3/22

Scripts result via ZAP API

Here is the variable I found in the code for the size limit static final int MAX_VALUE_SIZE = 1024 *

unread,

Scripts result via ZAP API

Here is the variable I found in the code for the size limit static final int MAX_VALUE_SIZE = 1024 *

3/3/22

12/2/21

input vector script and site tree

I use the zap input vector script to parse HTTP request custom parameters for zap sitetree (eg: a=

unread,

input vector script and site tree

I use the zap input vector script to parse HTTP request custom parameters for zap sitetree (eg: a=

12/2/21

NewZapScripter, … kingthorin+owaspzap10

9/8/21

How to override HTTP response in HTTP Sender

Ha ha! Thank you! I've managed to get this working by modifying the request to a failure uri in

unread,

How to override HTTP response in HTTP Sender

Ha ha! Thank you! I've managed to get this working by modifying the request to a failure uri in

9/8/21

Karthik U J, Simon Bennetts3

9/1/21

Documentation for zapproxy objects and methods

Sorry, I didn't know how active these groups were and I was a bit tight on time. Won't happen

unread,

Documentation for zapproxy objects and methods

Sorry, I didn't know how active these groups were and I was a bit tight on time. Won't happen

9/1/21

Varun K, thc...@gmail.com2

6/15/21

Community Scripts Update

Hi. There's a new version available in the marketplace. Best regards. On 11/06/2021 17:30, Varun

unread,

Community Scripts Update

Hi. There's a new version available in the marketplace. Best regards. On 11/06/2021 17:30, Varun

6/15/21

Ray Blitz, kingthorin+owaspzap2

6/15/21

Regarding Automating Modsec rules

I'm not aware of any such script. It also doesn't address the issue, just because you block

unread,

Regarding Automating Modsec rules

I'm not aware of any such script. It also doesn't address the issue, just because you block

6/15/21

Binhomolayzu Rekt, kingthorin+owaspzap2

6/1/21

Error on javascript running on graal engine

You need to follow the template(s) there are methods that are required. You can also draw inspiration

unread,

Error on javascript running on graal engine

You need to follow the template(s) there are methods that are required. You can also draw inspiration

6/1/21

4/16/21

Zest tutorial video!

Its been a very long time coming but I've finally recorded a video just focused on Zest! https://

unread,

Zest tutorial video!

Its been a very long time coming but I've finally recorded a video just focused on Zest! https://

4/16/21

Vanshaj Dhar, Simon Bennetts2

4/16/21

You actually have access to all of the ZAP classes and objects :) We have some old docs here: https:/

unread,

You actually have access to all of the ZAP classes and objects :) We have some old docs here: https:/

4/16/21

KHUSHBOO KUMARI, thc...@gmail.com3

3/23/21

Python add-on's proxy scripting not working properly

Hi @thc202, You can leave this. I wrote Java code in JavaScript script for the same task. I was just

unread,

Python add-on's proxy scripting not working properly

Hi @thc202, You can leave this. I wrote Java code in JavaScript script for the same task. I was just

3/23/21

KHUSHBOO KUMARI, thc...@gmail.com3

3/23/21

giving input file for ZAP Script

Hi @thc202, Would you please give an example like if I have variable "target" in my

unread,

giving input file for ZAP Script

Hi @thc202, Would you please give an example like if I have variable "target" in my

3/23/21

KHUSHBOO KUMARI, … thc...@gmail.com5

3/23/21

DOMParser() undefined while running JS own scripts

Hi. You can use the Java classes directly from the script (refer to syntax of the engine used). Best

unread,

DOMParser() undefined while running JS own scripts

Hi. You can use the Java classes directly from the script (refer to syntax of the engine used). Best

3/23/21

Khaled Nassar, … thc...@gmail.com8

1/25/21

import sas function in Passive Rule for send http request

Yeah, that add-on is not as automated. (There's a reflected XSS scan rule in ZAP.) You can do

unread,

import sas function in Passive Rule for send http request

Yeah, that add-on is not as automated. (There's a reflected XSS scan rule in ZAP.) You can do

1/25/21

Brayhan Zuluaga, Simon Bennetts2

12/15/20

Import a python script

You can configure the path to the directory with additional modules/libraries for Python scripting

unread,

Import a python script

You can configure the path to the directory with additional modules/libraries for Python scripting

12/15/20

12/11/20

New ZAP Scripting Video

Not only have we updated https://github.com/zaproxy/community-scripts with details of all of the

unread,

New ZAP Scripting Video

Not only have we updated https://github.com/zaproxy/community-scripts with details of all of the

12/11/20

11/23/20

ZEST action script

I see I didn't add the screenshot. Here it is: poniedziałek, 23 listopada 2020 o 12:55:00 UTC+1

unread,

ZEST action script

I see I didn't add the screenshot. Here it is: poniedziałek, 23 listopada 2020 o 12:55:00 UTC+1

11/23/20

11/13/20

How to change/add default payload in active scan

Hi guys, Recently, I try to develop some Active rule scripts for active scan. All thing seem to go as

unread,

How to change/add default payload in active scan

Hi guys, Recently, I try to develop some Active rule scripts for active scan. All thing seem to go as

11/13/20

Blazing Wind, thc...@gmail.com3

11/10/20

Using invalid protocol instead of HTTP in a request

Hi Oh, that's a pity. Nevertheless thanks for the quick response. Best regards poniedziałek, 9

unread,

Using invalid protocol instead of HTTP in a request

Hi Oh, that's a pity. Nevertheless thanks for the quick response. Best regards poniedziałek, 9

11/10/20

Search

Clear search

Close search

Google apps

Main menu