I have two set ups with ZAP and Selenium, local and on Jenkins.
Locally, I can start ZAP, run a Selenium process with ZAP as a proxy and then start the spider and then put ZAP in attack mode. This will turn up a number of issues.
On Jenkins, I have a build job that will start ZAP as a pre-build step, run the same selenium process through ZAP as a proxy as the build step and then run the spider and active scan as a post-build step. (I follow an approach very similar to this: https://wiki.jenkins.io/display/JENKINS/Execute+ZAP+as+part+of+a+Selenium+Build )
The latter approach turns up far fewer errors than the local approach. Why would this be?
On further inspection, it appears as though ZAP is not scanning every url that selenium accesses through ZAP as a proxy. It is as if it does not remember the urls accessed by Selenium and does not bother to scan them. But why would this happen? Are there any settings in the official ZAP plugin that I am missing which would determine this?
For some additional information, the application I am testing runs in Tomcat. ZAP appears to attack urls that are specific to Tomcat, such as http://[IP_Address]:[Port]/docs/default-servlet.html. Other than those, however, it seems to only attack those urls that were explicitly listed in the context (i.e. http://[IP_Address]:[Port]). At least, it only shows vulnerabilities pertaining to these.
Also, is it possible for me, in Jenkins, to see a full list of all the requests made as part of the active scan, just as I can in my local ZAP?