New answers tagged


Per: For a Java Applet the proxy details can be set via the Java Control Panel. Configure Proxies through the Java Control Panel In the Java Control Panel, under the General tab, click on Network Settings. Select the Use Browser Settings checkbox. Click OK to save your changes. Network Settings for the ...


We will be deprecating that passive scan rule shortly. Here's the issue: Here are the related PRs: You should really have CSP in place, as for whether or not it matters for those files it depends if they exist, ...


favicon.ico and robots.txt: No. Browsers do not execute JavaScript within these files. In theory, sitemap.xml could be an issue. There are lots of nasty tricks you can do with xml. In reality, it would be a very, very difficult attack to pull off (especially given the likely scenario that this is a static file).


It could be a False Positive. You can mark the alert as such, just double click it and set Confidence to False Positive. If you're seeing it a lot you could go into the Scan Policy and disable that one scan rule. You could also grab the Alert Filters addon and use it to tweak things. Lastly ZAP is Open Source so you could always check the source of the ...

Top 50 recent answers are included