ZAP Scanner

ZAP comes bundled with a Web Scanner similar to Burp Scanner. It is capable of building site maps using ZAP Spider and performing both passive and active scans to look for various types of vulnerabilities.

1. ZAP Spider

The ZAP Spider is a crawler feature used to discover links and map out a website, functioning similarly to Burp Crawler.

How to Start a Spider Scan

• Method 1 (Main UI): Go to the History tab, locate a request, right-click, and select Attack > Spider.
• Method 2 (HUD Browser): Visit the target page in the pre-configured browser, and click the Spider Start button (second button on the right pane).

Note: When starting a scan via the HUD, ZAP may prompt you that the website is out of scope. Click 'Yes' to automatically add it. The Scope determines which URLs ZAP will test, and it can be customized to include multiple targets.

Note: In some browser versions, the ZAP HUD might not work exactly as intended.

Progress and Results

• Progress: Tracked directly in the HUD (on the Spider button) or in the main ZAP UI (which automatically switches to the Spider tab).
• Results: Once complete, check the Sites tab in the main UI, or click the Sites Tree button (first button on the right pane in the HUD) for an expandable directory view of the target.

Tip - Ajax Spider: You can launch the Ajax Spider using the third button on the right pane. Unlike the standard spider, it renders the page and identifies links requested through JavaScript/AJAX even after the page loads. Run this after the normal Spider to catch hidden links (this process takes longer to finish).

2. Passive Scanner

The Passive Scanner runs automatically in the background as the ZAP Spider navigates the application.

• Functionality: It analyzes responses to identify potential source code issues (e.g., missing security headers, DOM-based XSS) without sending new malicious requests.
• Viewing Alerts: Alerts will populate before an Active Scan is initiated.
  • HUD Left Pane: Displays issues found on the current page.
  • HUD Right Pane: Displays overall alerts for the entire web application.
  • Main ZAP UI: Check the Alerts tab for a comprehensive list. Clicking an alert reveals its details and the affected pages.

3. Active Scanner

The Active Scanner targets the application by sending various payloads against identified pages and HTTP parameters to uncover deeper vulnerabilities.

Running an Active Scan