I'm trying to import and scan Open API Definitions and it seems to me that the url parameters and request body are not being replaced with real data. Is there a way for OWASP ZAP to automatically replace those parameters and body requests with real data? If not, what other optimum solutions are there solve this?

Thanks in advance!

  • Define "real data". Names? Addresses? Email? Phone numbers? Comments? Blog posts? Youtube videos? Mar 12, 2020 at 17:55
  • Social security numbers? Immigration history? Cookie recipes? Pet names? Mar 12, 2020 at 17:57
  • @ConorMancone real data meaning data that are already existing in the webserver. For example in sample.com/clinic_id, the clinic_id must be replaced with a valid id number in such a way the owasp zap would not produce an invalid url. Mar 13, 2020 at 5:20

2 Answers 2


The best option is to proxy requests that use real data through ZAP. These could be unit tests or something as simple as command line calls to curl. You can also make calls to the target system using the ZAP API.

The Form Handler add-on also allows you to specify values for individual fields, but I dont think this handles URL parameters.

  • 2
    Thanks Simon, this is exactly what I was looking for! Mar 13, 2020 at 22:49

I am guessing you are referring to the Active Scanner feature of Zap. The active scanner first looks at the discovered site nodes on the left side panel. So before running the active scan, you first want to populate those site nodes. You can do this with the spider, forced browsing (i.e. dirbuster), or manual browsing with the proxy. Then, once those nodes are populated you want to manually review them and adjust them if necessary.

From https://www.zaproxy.org/docs/desktop/start/features/structmods/ : — “The Sites tab show ZAP's representation of the application. If it is not a good representation of the structure then ZAP will not be able to attack the application effectively. There are currently 2 types of Structural Modifiers: * Data Driven Content which identify URL paths that represent data * Structural Parameters which identify parameters that represent application structure instead of user data” —

To adjust the structure of the Sites tab in order to Zap to attack it efficiently you must define contexts around the nodes, to group them or split them. Grouping the data driven ones is explained here: https://www.zaproxy.org/docs/desktop/start/features/ddc/ Splitting the structural ones is explained here: https://www.zaproxy.org/docs/desktop/start/features/structparams/

Then, once the Sites tab is structured in a logical way, you can begin your attack. My understanding is that in the Sites tab, the nodes defined as structural will be treated as such, so will be using the “real” key,value pairs defined by the site, whereas the nodes flagged as data will be treated as payload input vectors. The Active Scan might still try tampering with the structured parameters to look for certain vulnerabilities, but most of the tampering should be on the data parameters I believe.

Also, with the Zap Fuzzer feature, you can control which locations are fuzzed, such as a particular parameter you want to tamper with. Read more about that here: https://www.zaproxy.org/docs/desktop/addons/fuzzer/

You might also be interested in the FuzzDB Files addon: https://www.zaproxy.org/docs/desktop/addons/fuzzdb-files/

This guide is also worth checking out: https://medium.com/volosoft/running-penetration-tests-for-your-website-as-a-simple-developer-with-owasp-zap-493d6a7e182b

Hope I answered your question, or at least pointed you in the right direction.

  • Thank you for the suggestions! Apologies if the question seemed to be confusing. To clarify, what I wanna do is that do an active scan on the API Endpoints which contain parameter variable in the url such as {user_id} and replace them with a valid data. This is to ensure that I won't get any server error saying that the url does not exists and scan it properly. I've solved this by using Form Handle Add-on. Mar 13, 2020 at 22:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .