New answers tagged vulnerability-scanners
1
A host-based vulnerability scanner is not required to use a Client/Server architecture. Host-based only means, that the scanner runs on the same machine that it is scanning.
If it uses a Client/Server pattern, the client is the agent running on the host. The server is usually a central orchestrator, managing the individual agents. This makes sense in larger ...
0
For situation one, create your own variant or HttpSender script.
https://github.com/zaproxy/community-scripts/tree/master/variant
https://github.com/zaproxy/community-scripts/tree/master/httpsender
For situation two, use the Sequence addon:
https://www.zaproxy.org/docs/desktop/addons/sequence-scanner/
2
Is the charset of CSS and JavaScript resources strictly defined by a standard?
No. It is similarly flexible as with HTML, i.e. can be defined in the style itself, by the embedding HTML or in the HTTP header or even with a byte order mark. If not explicitly defined it might also have a default or might depend on the charset encoding of the embedding document:...
0
I am guessing you are referring to the Active Scanner feature of Zap. The active scanner first looks at the discovered site nodes on the left side panel. So before running the active scan, you first want to populate those site nodes. You can do this with the spider, forced browsing (i.e. dirbuster), or manual browsing with the proxy. Then, once those ...
1
The best option is to proxy requests that use real data through ZAP. These could be unit tests or something as simple as command line calls to curl. You can also make calls to the target system using the ZAP API.
The Form Handler add-on also allows you to specify values for individual fields, but I dont think this handles URL parameters.
2
Your questions is best answered by the Web Application Vulnerability Scanner Evaluation Project (WAVSEP). Take a look at chapter "3.3 Support for Crucial SSDLC Integration Features".
Concerning automation, the following categories will be most interesting to you, depending on the type of automation you are aiming for:
Continuous Integration Support (BDD) ...
0
If your session is already persisted then just exit. ZAP will tell you there's still a bunch of stuff to passive scan but you can say you don't care and exit anyway.
There's also this long standing enhancement ticket: https://github.com/zaproxy/zaproxy/issues/3813 if you feel up for contributing and making things even better.
Top 50 recent answers are included
