ZAP active scanner

[Mark]

Hi,I was wondering if ZAP's Active Scan attack every endpoint that was discovered during the Spidering phase, or only a subset of them.

[Simon Bennetts]

It all depends on how you are running ZAP, and how you have configured it :)

By default ZAP only does what you tell it to do, so it you are running the ZAP desktop it will only run the Active Scanner when you tell it to, and you can tell it what to attack.

The Active Scanner also works of the Sites Tree, which is ZAP's internal representation of the app: https://www.zaproxy.org/docs/desktop/start/features/sitestree/

Have a look at that link and if you have any more questions about this then let us know how you are running ZAP.

Cheers,

Simon