search

secureCodeBox / scanner-webapplication-zap

Part of the deprecated secureCodeBox v1, see secureCodeBox/secureCodeBox Repo for v2
Apache License 2.0
5 stars 4 forks source link

Improve zap scan handling #7

Closed J12934 closed 6 years ago

J12934 commented 6 years ago
  1. ZAP Spider Findings now include the entire HAR (HTTP Archive) Information about their requests. This ensures that this exact request will be re imported by the scanner.
  2. ZAP Scanner now uses HAR to replay the spider requests. This means that the sitemap tree can be completely restored, even for non GET or POST request with all http body data.

This is still not totally effective as all spider request are resubmitted before scanning. If this becomes an issues in future we can add a new endpoint to zap to import spider request and response at the same time without the requirement to replay the requests.

J12934 commented 6 years ago
  1. Zap findings now get transformed via a manual mapping rather than via JSON decoding magic. This way the Zap findings Attributes now better match the attributes of the findings of the other scanner.
  2. Zap findings now have the HAR of the attack request saved in their attributes. This should ensure that every finding can be properly reproduced.