OWASP ZAP User Group

1–30 of 6017

Welcome to the OWASP Zed Attack Proxy (ZAP) User Group.
Please use this group for any questions about using ZAP, or for any enhancement requests you may have.
If you're having a problem with ZAP and dont know where to start then have a look at this FAQ first.
And if you post spam then it will be deleted and your account blocked.

0 selected

10:16 AM

password cracking using docker image

Hello I have recently start scanning my app using ZAP docker image owasp/zap2docker-stable. I used

unread,

password cracking using docker image

Hello I have recently start scanning my app using ZAP docker image owasp/zap2docker-stable. I used

10:16 AM

洪嘉佑, Simon Bennetts4

6:49 AM

Two question about ZAP API

Have you waited for the passive scan queue to empty? The policy file needs to be locally accessible.

unread,

Two question about ZAP API

Have you waited for the passive scan queue to empty? The policy file needs to be locally accessible.

6:49 AM

Jack Cook, Simon Bennetts3

4:51 AM

ZAP: missing_parameter

CASA do not appear to be very good at sharing ways to get in contact with themselves ;) I've

unread,

ZAP: missing_parameter

CASA do not appear to be very good at sharing ways to get in contact with themselves ;) I've

4:51 AM

Sai Theja Pamarty, … Simon Bennetts12

4:48 AM

ZAP Automation Framework for SOAP and REST Scanning

Hiya, I must admit that "REST V2 Resource" is a format I have not heard about before. Do

unread,

ZAP Automation Framework for SOAP and REST Scanning

Hiya, I must admit that "REST V2 Resource" is a format I have not heard about before. Do

4:48 AM

Gary Guo (Gary Guo), Simon Bennetts4

2:57 AM

different scan results in the report

By the way , I checked the logs in zap.log , then get the following information , which shows that

unread,

different scan results in the report

By the way , I checked the logs in zap.log , then get the following information , which shows that

2:57 AM

James M, … thc...@gmail.com4

Mar 30

ZAP UI Automation Framework env variables issues

Note that that variable should be a system environment variable not one of the plan. More details in:

unread,

ZAP UI Automation Framework env variables issues

Note that that variable should be a system environment variable not one of the plan. More details in:

Mar 30

Pritish Thapa, Simon Bennetts3

Mar 30

Form based + HTTP Sender script in command line

That's amazing Simon, I wonder what else ZAP can do. By the way, I had a query... I did an ajax

unread,

Form based + HTTP Sender script in command line

That's amazing Simon, I wonder what else ZAP can do. By the way, I had a query... I did an ajax

Mar 30

Pritish Thapa, Simon Bennetts5

Mar 30

scan from UI and report through command prompt?

got that Simon, but I have performed a scan of my website through ZAP UI, so I wondered that can'

unread,

scan from UI and report through command prompt?

got that Simon, but I have performed a scan of my website through ZAP UI, so I wondered that can'

Mar 30

Mar 30

Outgoing proxy setup in corporate env - connection tab

So is everything working for you now? Cheers, Simon On Thu, Mar 30, 2023 at 8:38 AM Jon Godden <

unread,

Outgoing proxy setup in corporate env - connection tab

So is everything working for you now? Cheers, Simon On Thu, Mar 30, 2023 at 8:38 AM Jon Godden <

Mar 30

mir, … Simon Bennetts14

Mar 30

restrictions on AJAX SPIDER

Thank you very much! I realised!, I will now try to use it. There is an example of a project that

unread,

restrictions on AJAX SPIDER

Thank you very much! I realised!, I will now try to use it. There is an example of a project that

Mar 30

rdans, … Jon Godden7

Mar 30

Connection reset error after updating to 2.8

This may be unrelated, but I was also getting connection reset when trying to do an Automated Scan on

unread,

Connection reset error after updating to 2.8

This may be unrelated, but I was also getting connection reset when trying to do an Automated Scan on

Mar 30

Mar 29

ZAP API can't find node in site tree by URL

Hello everyone, I am using ZAP to scan local websites with the Python API, of which I can't find

unread,

ZAP API can't find node in site tree by URL

Hello everyone, I am using ZAP to scan local websites with the Python API, of which I can't find

Mar 29

sunny shi, Simon Bennetts3

Mar 28

The ZAP will not response after launching for long time

Ok, I will try it, thanks for your help. 在2023年3月28日星期二 UTC+8 18:22:22<psi...@gmail.com> 写道：

unread,

The ZAP will not response after launching for long time

Ok, I will try it, thanks for your help. 在2023年3月28日星期二 UTC+8 18:22:22<psi...@gmail.com> 写道：

Mar 28

Lakmi SK, … thc...@gmail.com7

Mar 28

How to generate html report from command line?

For the record, zap-cli is no longer maintained. Best regards. On 28/03/2023 20:01, Pritish Thapa

unread,

How to generate html report from command line?

For the record, zap-cli is no longer maintained. Best regards. On 28/03/2023 20:01, Pritish Thapa

Mar 28

Naveen Rajamannar, … thc...@gmail.com8

Mar 28

Capturing zap logs from docker

In your custom Log4j configuration create your own console appender, the existing one (`console`) is

unread,

Capturing zap logs from docker

In your custom Log4j configuration create your own console appender, the existing one (`console`) is

Mar 28

Mar 28

Community script vulnerability: curl_command_generator.js

James Kettle has just published a blog post which explained how both Burp and Chrome were vulnerable

unread,

Community script vulnerability: curl_command_generator.js

James Kettle has just published a blog post which explained how both Burp and Chrome were vulnerable

Mar 28

洪嘉佑, Simon Bennetts4

Mar 28

Getting passive scan result by using API

Answered here: https://groups.google.com/g/zaproxy-users/c/R2GS8MrDrKw/m/CvijQsRKAgAJ Cheers, Simon

unread,

Getting passive scan result by using API

Answered here: https://groups.google.com/g/zaproxy-users/c/R2GS8MrDrKw/m/CvijQsRKAgAJ Cheers, Simon

Mar 28

Gary Guo (Gary Guo), Simon Bennetts2

Mar 28

error in Header-based Session Management

Have you updated all of the other add-ons? I think thats already been fixed in the latest version of

unread,

error in Header-based Session Management

Have you updated all of the other add-ons? I think thats already been fixed in the latest version of

Mar 28

mir, Simon Bennetts4

Mar 28

DEFAULT SCAN repeats the same URL

The results dont go into a separate tree - there is only one Sites Tree, everything goes into that.

unread,

DEFAULT SCAN repeats the same URL

The results dont go into a separate tree - there is only one Sites Tree, everything goes into that.

Mar 28

Zhafran, … Simon Bennetts6

Mar 28

Unable to access ZAP API remotely

Thanks for letting us know! On Tuesday, 28 March 2023 at 07:28:58 UTC+1 zhaf...@gmail.com wrote:

unread,

Unable to access ZAP API remotely

Thanks for letting us know! On Tuesday, 28 March 2023 at 07:28:58 UTC+1 zhaf...@gmail.com wrote:

Mar 28

Naveen Rajamannar, Simon Bennetts2

Mar 27

Running scripts in a docker

I just tried this: echo "print('hi');" > test.sh ./zap.sh -cmd -script test.js

unread,

Running scripts in a docker

I just tried this: echo "print('hi');" > test.sh ./zap.sh -cmd -script test.js

Mar 27

Mike Z, … Simon Bennetts4

Mar 27

Clarity on ZAP Active Scan

Thank you! On Monday, March 27, 2023 at 9:56:47 AM UTC-4 psi...@gmail.com wrote: ZAP is not attacking

unread,

Clarity on ZAP Active Scan

Thank you! On Monday, March 27, 2023 at 9:56:47 AM UTC-4 psi...@gmail.com wrote: ZAP is not attacking

Mar 27

Pritish Thapa, Simon Bennetts2

Mar 27

Why is ZAP hitting 2 urls one after the other!

ZAP is trying to authenticate to your app. Have a look at https://www.zaproxy.org/docs/authentication

unread,

Why is ZAP hitting 2 urls one after the other!

ZAP is trying to authenticate to your app. Have a look at https://www.zaproxy.org/docs/authentication

Mar 27

Gilberto Fernandez, Simon Bennetts2

Mar 27

Vulnerability Acceptance Level

That entirely depends on the app and your appetite for risk :) Is this a POC someones knocked up on a

unread,

Vulnerability Acceptance Level

That entirely depends on the app and your appetite for risk :) Is this a POC someones knocked up on a

Mar 27

Sai Theja Pamarty, psiinon4

Mar 27

ZAP Automation Framework Errors

By default ZAP will listen on localhost:8080 but you can change the host and port via the commandline

unread,

ZAP Automation Framework Errors

By default ZAP will listen on localhost:8080 but you can change the host and port via the commandline

Mar 27

Gary Guo (Gary Guo), thc...@gmail.com5

Mar 27

error in running docker authentication scan

Shouldn't the path be: /zap/wrk/JuiceShopSession.js Best regards. On 23/03/2023 07:31, Gary Guo (

unread,

error in running docker authentication scan

Shouldn't the path be: /zap/wrk/JuiceShopSession.js Best regards. On 23/03/2023 07:31, Gary Guo (

Mar 27

Wang Kevin, thc...@gmail.com12

Mar 27

Some content can’t be displayed when opening a web page through the zap proxy

Thank you! That's a problem related to server-sent events. Will check what's wrong. Best

unread,

Some content can’t be displayed when opening a web page through the zap proxy

Thank you! That's a problem related to server-sent events. Will check what's wrong. Best

Mar 27

Muhammad Zubair, … Simon Bennetts9

Mar 27

Request for Method to Clear ZAP History Using Python API zap.core.clear_history()

You may struggle with that as ZAP doesnt really perform SAST, except for some very specific Java

unread,

Request for Method to Clear ZAP History Using Python API zap.core.clear_history()

You may struggle with that as ZAP doesnt really perform SAST, except for some very specific Java

Mar 27

Fabietto, thc...@gmail.com2

Mar 27

Check list of every scan made by the scanners

Hi. Answers inline. On 24/03/2023 17:01, Fabietto wrote: > Hi everyone! > I'm using ZAP

unread,

Check list of every scan made by the scanners

Hi. Answers inline. On 24/03/2023 17:01, Fabietto wrote: > Hi everyone! > I'm using ZAP

Mar 27

Muhammad Zubair

Mar 27

Using ZAP as a Long-Running Service for SAST: My Experience and Future Plans

Hello Zap Team, Thank you for your comment. I would like to share my experience using ZAP as a long

unread,

Using ZAP as a Long-Running Service for SAST: My Experience and Future Plans

Hello Zap Team, Thank you for your comment. I would like to share my experience using ZAP as a long

Mar 27

Search

Clear search

Close search

Google apps

Main menu