Scanning an app with Single URL

[sparry]

Hi, I hope someone can help out with this.  We have a web app that only uses a single url as all navigation etc goes through a navigation servlet.

So each page shows as https://domainname/product/nav

I'm trying to find some way to scan the application, navigate through pages etc to pick up any vulnerabilities.

I'm new to ZAP and couldn't find any references to this they all seem to expect urls with jsp names in them

https://domainname/product/page.jsp.

Thanks all.

[kingthorin+owaspzap]

Sounds like you probably need to define structural parameters.

https://www.zaproxy.org/docs/desktop/start/features/structparams/

[Simon Bennetts]

You will also need to explore the app using a good set of unit tests proxied through ZAP and/or the Ajax Spider: https://www.zaproxy.org/docs/desktop/addons/ajax-spider/

Cheers,

Simon

[sparry]

Thank you both for the prompt response, I will go through those links.

Regards