automated scan flagging the host subdomain as out of scop

[proctor smith]

Hi, how can i make the scan to test all subdomain zap found in automated scan. i tried setting some regex patterns in contexts setting but it does not work

[Simon Bennetts]

Define a context including all of the subdomains, e.g.

• https://www.example.* 

then, for example, when you crawl https://www.example.com and get some content from https://www.example.api then active scanning that context will attack both domains.

Cheers,

Simon

[Simon Bennetts]

Sorry, for subdomains it should be:

• https://.*.example.com

but hopefully you got the general idea :)

Cheers,

Simon