I'm trying to compile a list of vulnerabilities that ZAP tries to find when you run the "Active Scan" in ATTACK mode on a webapp. Does this list exist in the documentation anywhere? If it also has a list of all the inputs that it tries that would be very helpful.

1 Answer 1


We have a FAQ for that :) https://github.com/zaproxy/zaproxy/wiki/FAQzaptests

ZAP has a built in set of 'input vectors' https://github.com/zaproxy/zap-core-help/wiki/HelpUiDialogsOptionsAscaninput but you can also define your own via script input vectors: https://github.com/zaproxy/zap-core-help/wiki/HelpAddonsScriptsScripts


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .