ZAP User Group

Contact owners and managers

1–30 of 7535

Welcome to the Zed Attack Proxy (ZAP) User Group.
Please use this group for any questions about using ZAP, or for any enhancement requests you may have.

If you're having a problem with ZAP and dont know where to start then have a look at this FAQ first.

Don't ask the same question on multiple ZAP forums - the ZAP Core Team monitors all of them.

And if you post spam then it will be deleted and your account blocked.

0 selected

Julia Khanbekova, kingthorin+zap3

1:08 AM

scan API with bearer token

Is it possible to scan one endpoint in zap-api-scan? Not all endpoints from openapi.json? On

unread,

scan API with bearer token

Is it possible to scan one endpoint in zap-api-scan? Not all endpoints from openapi.json? On

1:08 AM

Sachin Verlekar

Nov 20

Spider crawling issue

Hi Simon, There is a problem that i am facing with my application newly wherein now i need to run the

unread,

Spider crawling issue

Hi Simon, There is a problem that i am facing with my application newly wherein now i need to run the

Nov 20

Julia Khanbekova

Nov 20

OpenAPI yaml scan

Hi Simon! I'll try to scan openapi by running the zap.sh script. But have an error: Job openapi

unread,

OpenAPI yaml scan

Hi Simon! I'll try to scan openapi by running the zap.sh script. But have an error: Job openapi

Nov 20

Luca Dost, … Simon Bennetts4

Nov 19

Automation Framework with my own Report template

I've just tried it locally with the latest weekly release and it worked fine for me. Double check

unread,

Automation Framework with my own Report template

I've just tried it locally with the latest weekly release and it worked fine for me. Double check

Nov 19

Sachin Verlekar, Simon Bennetts2

Nov 19

Want to reinitiate login after detected 401 Unauthorized on Scan progress

Hi Sachin, So you are talking about authentication, in which case you should start here: https://www.

unread,

Want to reinitiate login after detected 401 Unauthorized on Scan progress

Hi Sachin, So you are talking about authentication, in which case you should start here: https://www.

Nov 19

Luiz, Simon Bennetts4

Nov 19

Web API scanning - replace target URL parameter before send

Hi Luiz, As you are already changing the swagger file just change the URLs to be absolute rather than

unread,

Web API scanning - replace target URL parameter before send

Hi Luiz, As you are already changing the swagger file just change the URLs to be absolute rather than

Nov 19

Sachin Verlekar, Simon Bennetts6

Nov 19

Proxy header misuse knowledge base taking too much time to perform its assessment

You can do it via the disableScanners API endpoint. If you have not specified a scan policy when

unread,

Proxy header misuse knowledge base taking too much time to perform its assessment

You can do it via the disableScanners API endpoint. If you have not specified a scan policy when

Nov 19

Jonathan Wilbert Gunawan

Nov 19

How to Make ZAP Scan Results More Specific for Certain Folders or Endpoints?

Hi everyone, I'm using ZAP to perform vulnerability scans on my website, but I'm facing an

unread,

How to Make ZAP Scan Results More Specific for Certain Folders or Endpoints?

Hi everyone, I'm using ZAP to perform vulnerability scans on my website, but I'm facing an

Nov 19

Nov 19

Hi team, I want to know any personalised and in-depth assistance will be provided to me by paying for

unread,

Hi team, I want to know any personalised and in-depth assistance will be provided to me by paying for

Nov 19

naya...@gmail.com

Nov 18

ZAP throwing ConfigurationException : Cannot load a configuration from a directory

Hi team, Ran into a random issue in an already smoothly running setup. I have automated ZAP. I run

unread,

ZAP throwing ConfigurationException : Cannot load a configuration from a directory

Hi team, Ran into a random issue in an already smoothly running setup. I have automated ZAP. I run

Nov 18

Maxim Voronetski, … Simon Bennetts25

Nov 18

Zap Error: 'Alert on Unexpected Content Types' script

Sorry, how can I disable those when launching ZAP scan via CLI? четверг, 14 ноября 2024 г. в 12:49:56

unread,

Zap Error: 'Alert on Unexpected Content Types' script

Sorry, how can I disable those when launching ZAP scan via CLI? четверг, 14 ноября 2024 г. в 12:49:56

Nov 18

Simon Bennetts, Dan Kegel2

Nov 17

Packaged API scan changes

Thanks! What version does that yaml file require? I tried it with release 2.15.0, being careful to

unread,

Packaged API scan changes

Thanks! What version does that yaml file require? I tried it with release 2.15.0, being careful to

Nov 17

Aakash Dev, Simon Bennetts3

Nov 15

Token Refresher in script based authentication

Hi Simon, I am running ZAP Desktop and I can see live logs from the script console, I can also see

unread,

Token Refresher in script based authentication

Hi Simon, I am running ZAP Desktop and I can see live logs from the script console, I can also see

Nov 15

Carlo Marchiori

Nov 15

NullPointerException while running zap inside docker

Hello, I run the attached script inside docker using either version 2.15.0 or latest using the

unread,

NullPointerException while running zap inside docker

Hello, I run the attached script inside docker using either version 2.15.0 or latest using the

Nov 15

Nov 15

Insufficient Site Isolation Against Spectre Vulnerability alert only raised on 1 endpoint

Hi, We are using zap automated scan in our ci pipeline for several services/endpoints. On one of

unread,

Insufficient Site Isolation Against Spectre Vulnerability alert only raised on 1 endpoint

Hi, We are using zap automated scan in our ci pipeline for several services/endpoints. On one of

Nov 15

Sebastian Bahler, … Simon Bennetts5

Nov 14

Connectivity issues between container/services on github action workflow

Can I get help with something ? I've been running nmap scans on the scanme.nmap.org but after a

unread,

Connectivity issues between container/services on github action workflow

Can I get help with something ? I've been running nmap scans on the scanme.nmap.org but after a

Nov 14

Simon Bennetts, … Sachin Verlekar5

Nov 14

Blog post: Powering Up DAST with ZAP and Noir

Best ask them via one of their issues :) On Wednesday 13 November 2024 at 14:58:46 UTC xtremes...@

unread,

Blog post: Powering Up DAST with ZAP and Noir

Best ask them via one of their issues :) On Wednesday 13 November 2024 at 14:58:46 UTC xtremes...@

Nov 14

Nov 14

The Futue of DAST and ZAP

We had as great webinar on LinkedIn yesterday, and covered things like future Hackathons and ZAP Cons

unread,

The Futue of DAST and ZAP

We had as great webinar on LinkedIn yesterday, and covered things like future Hackathons and ZAP Cons

Nov 14

Nov 13

DevOps Dozen Awards 2024 Finalist

Just to let you all know that ZAP is a finalist for the DevOps Dozen Awards 2024! https://devops.com/

unread,

DevOps Dozen Awards 2024 Finalist

Just to let you all know that ZAP is a finalist for the DevOps Dozen Awards 2024! https://devops.com/

Nov 13

Sebastian Bahler, … Simon Bennetts4

Nov 13

Permission denied writing report

Thanks for letting us know! On Tuesday 12 November 2024 at 22:06:05 UTC seba...@serfe.com wrote:

unread,

Permission denied writing report

Thanks for letting us know! On Tuesday 12 November 2024 at 22:06:05 UTC seba...@serfe.com wrote:

Nov 13

Kuldeep Patil, Simon Bennetts2

Nov 13

Assistance Required: ZAP Docker Config File Parsing Error

Hi Kuldeep, As per the error message, your config file is invalid. If you cannot work out why then

unread,

Assistance Required: ZAP Docker Config File Parsing Error

Hi Kuldeep, As per the error message, your config file is invalid. If you cannot work out why then

Nov 13

Asmir Sinanovic, Simon Bennetts4

Nov 13

Intermittent Scan Results

Hi Asmir, If it is a valid finding them I would hope it would always be found. However consistency

unread,

Intermittent Scan Results

Hi Asmir, If it is a valid finding them I would hope it would always be found. However consistency

Nov 13

Matteo B, … Abdulkadir Ibrahim4

Nov 12

Sites to test Network Scanner

i think you should use nslookup on the home url to get the ip addresses on the legally allowed sites

unread,

Sites to test Network Scanner

i think you should use nslookup on the home url to get the ip addresses on the legally allowed sites

Nov 12

Nov 11

The future of DAST and ZAP at Checkmarx

Want to hear more about the future of DAST and ZAP at Checkmarx? Come along to https://www.linkedin.

unread,

The future of DAST and ZAP at Checkmarx

Want to hear more about the future of DAST and ZAP at Checkmarx? Come along to https://www.linkedin.

Nov 11

Sachin Verlekar, Simon Bennetts4

Nov 8

Website loads slowly on ZAP scanner

Replies inline On Friday 8 November 2024 at 17:19:27 UTC xtremes...@gmail.com wrote: Hi Simon,

unread,

Website loads slowly on ZAP scanner

Replies inline On Friday 8 November 2024 at 17:19:27 UTC xtremes...@gmail.com wrote: Hi Simon,

Nov 8

Naveen Sabavath, Simon Bennetts5

Nov 8

Assistance Required for Authentication Scanning in ZAP for OTP and Two-Factor Authentication URLs

Following on from your other thread, I suggest you print out all of the nodes in the Sites tree after

unread,

Assistance Required for Authentication Scanning in ZAP for OTP and Two-Factor Authentication URLs

Following on from your other thread, I suggest you print out all of the nodes in the Sites tree after

Nov 8

Naveen Sabavath, Simon Bennetts3

Nov 8

Issues with Active Scans for Script based Authenticationas a User via ZAP AP

Asking related questions on different threads makes things very confusing. Please stick to one thread

unread,

Issues with Active Scans for Script based Authenticationas a User via ZAP AP

Asking related questions on different threads makes things very confusing. Please stick to one thread

Nov 8

Lighter ST, Simon Bennetts2

Nov 8

selenium script for all spider threads

Thats essentially how Browser Based Authentication works: https://www.zaproxy.org/docs/desktop/addons

unread,

selenium script for all spider threads

Thats essentially how Browser Based Authentication works: https://www.zaproxy.org/docs/desktop/addons

Nov 8

Hachem Tlili, Simon Bennetts13

Nov 8

Zap fullscan issue

The key line in the output is: "Job spiderAjax found 0 URLs" Have a look at https://www.

unread,

Zap fullscan issue

The key line in the output is: "Job spiderAjax found 0 URLs" Have a look at https://www.

Nov 8

Asker, … thc...@gmail.com3

Nov 6

HTTP sender script don't processes active scan request after re-auth

And they get disabled when the script has an error (which would explain why some requests no longer

unread,

HTTP sender script don't processes active scan request after re-auth

And they get disabled when the script has an error (which would explain why some requests no longer

Nov 6

Search

Clear search

Close search

Google apps

Main menu