A set of ZAP authentication and automation workshops produced in conjunction with All Day DevOps. -Also available on https://www.alldaydevops.com/zap-in-ten
+Unfortunately the ZAP authentication and automation workshop videos were hosted on another site, and deleted without informing us.
- 
- 
- 
- 
- 
- 
- 
- 
You can also import the add-ons that you have downloaded manually via the “File / Load Add-on File…” menu option in the ZAP desktop.
+If you would like to publish your own add-on on the Marketplace then follow the +How to Publish a ZAP Add-on guide.
| - 71 + 74 |
release
@@ -200,7 +202,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-03-04 + 2025-09-18 | - 48 + 52 |
alpha
@@ -235,7 +237,7 @@ ZAP MarketplaceZAP Dev Team |
- 2024-09-02 + 2025-10-07 | @@ -248,7 +250,7 @@- 58 + 62 |
beta
@@ -270,7 +272,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-03-04 + 2025-09-18 | @@ -283,10 +285,12 @@- 15 + 16 |
beta
@@ -303,7 +307,7 @@ ZAP MarketplaceAndrea Pompili (Yhawke) |
- 2021-10-20 + 2025-04-30 | @@ -316,7 +320,7 @@- 23.22.0 + 23.26.0 |
release
@@ -338,7 +342,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-01-10 + 2025-09-02 | @@ -351,7 +355,7 @@- 23 + 24 |
release
@@ -373,7 +377,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-01-09 + 2025-06-20 | @@ -452,7 +456,7 @@- 0.23.0 + 0.29.0 |
beta
@@ -474,7 +478,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-03-04 + 2025-09-18 | @@ -520,7 +524,7 @@- 0.48.0 + 0.53.0 |
beta
@@ -542,7 +546,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-03-04 + 2025-09-18 | @@ -687,7 +691,7 @@- 0.14.0 + 0.16.0 |
release
@@ -709,7 +713,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-01-09 + 2025-10-22 | @@ -722,7 +726,7 @@- 0.14.0 + 0.17.0 |
alpha
@@ -744,7 +748,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-03-04 + 2025-09-02 | @@ -823,7 +827,7 @@- 1.30.0 + 1.38.0 |
release
@@ -845,7 +849,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-01-09 + 2025-10-21 | @@ -924,7 +928,7 @@- 0.14.0 + 0.15.0 |
release
@@ -946,7 +950,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-01-15 + 2025-09-02 | @@ -994,7 +998,7 @@- 0.9.0 + 0.10.0 |
alpha
@@ -1016,7 +1020,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-01-31 + 2025-05-15 | @@ -1165,7 +1169,7 @@- 21 + 22 |
release
@@ -1187,7 +1191,7 @@ ZAP MarketplaceAabha Biyani, ZAP Dev Team |
- 2025-01-09 + 2025-07-10 | @@ -1200,7 +1204,7 @@- 1.6.0 + 1.7.0 |
release
@@ -1222,7 +1226,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-01-09 + 2025-06-20 | @@ -1303,7 +1307,7 @@- 17 + 18 |
beta
@@ -1325,7 +1329,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-01-09 + 2025-08-27 | @@ -1439,7 +1443,7 @@- 13.15.0 + 13.16.0 |
beta
@@ -1461,7 +1465,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-01-09 + 2025-06-20 | @@ -1509,7 +1513,7 @@- 0.9.0 + 0.10.0 |
alpha
@@ -1531,7 +1535,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-01-09 + 2025-10-07 | @@ -1544,7 +1548,7 @@- 0.26.0 + 0.28.0 |
alpha
@@ -1566,7 +1570,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-01-09 + 2025-03-26 | @@ -1643,13 +1647,13 @@
- Help - Arabic
+ Help - Arabic
- 
+
@@ -1660,7 +1664,7 @@ ZAP Marketplacehelp_ar_SA |
- 1 + 2 |
alpha
@@ -1669,18 +1673,20 @@ ZAP MarketplaceZAP Crowdin Team |
- 2022-01-18 + 2025-08-21 | ||
- Help - Bosnian
+ Help - Bosnian
+
+
-
+
@@ -1691,7 +1697,7 @@ ZAP Marketplacehelp_bs_BA |
- 9 + 10 |
alpha
@@ -1700,20 +1706,20 @@ ZAP MarketplaceZAP Crowdin Team |
- 2018-02-08 + 2025-08-21 | ||
- Help - Chinese Simplified
+ Help - Chinese Simplified
-
+
@@ -1724,16 +1730,16 @@ ZAP Marketplacehelp_zh_CN |
- 3 + 4 | - beta + release | ZAP Crowdin Team | - 2022-01-18 + 2025-08-21 | - 19 + 21 |
release
@@ -1766,20 +1772,20 @@ ZAP MarketplaceZAP Crowdin Team |
- 2025-01-10 + 2025-08-21 |
- Help - Filipino
+ Help - Filipino
-
+
@@ -1790,29 +1796,29 @@ ZAP Marketplacehelp_fil_PH |
- 3 + 4 | - alpha + release | ZAP Crowdin Team | - 2022-01-18 + 2025-08-21 | |
- Help - French
+ Help - French
-
+
@@ -1823,7 +1829,7 @@ ZAP Marketplacehelp_fr_FR |
- 10 + 11 |
alpha
@@ -1832,20 +1838,20 @@ ZAP MarketplaceZAP Crowdin Team |
- 2022-01-18 + 2025-08-21 | ||
- Help - Indonesian
+ Help - Indonesian
-
+
@@ -1856,29 +1862,29 @@ ZAP Marketplacehelp_id_ID |
- 3 + 4 | - beta + release | ZAP Crowdin Team | - 2022-01-18 + 2025-08-21 | |
- Help - Japanese
+ Help - Japanese
-
+
@@ -1889,7 +1895,7 @@ ZAP Marketplacehelp_ja_JP |
- 10 + 11 |
beta
@@ -1898,20 +1904,20 @@ ZAP MarketplaceZAP Crowdin Team |
- 2022-01-18 + 2025-08-21 | ||
- Help - Malay
+ Help - Malay
-
+
@@ -1922,7 +1928,7 @@ ZAP Marketplacehelp_ms_MY |
- 1 + 2 |
alpha
@@ -1931,20 +1937,20 @@ ZAP MarketplaceZAP Crowdin Team |
- 2022-01-18 + 2025-08-21 | ||
- Help - Portuguese, Brazilian
+ Help - Portuguese, Brazilian
-
+
@@ -1955,7 +1961,7 @@ ZAP Marketplacehelp_pt_BR |
- 11 + 12 |
release
@@ -1964,20 +1970,20 @@ ZAP MarketplaceZAP Crowdin Team |
- 2022-01-18 + 2025-08-21 | ||
- Help - Russian
+ Help - Russian
-
+
@@ -1988,7 +1994,7 @@ ZAP Marketplacehelp_ru_RU |
- 2 + 3 |
release
@@ -1997,20 +2003,20 @@ ZAP MarketplaceZAP Crowdin Team |
- 2022-02-24 + 2025-08-21 | ||
- Help - Spanish
+ Help - Spanish
-
+
@@ -2021,7 +2027,7 @@ ZAP Marketplacehelp_es_ES |
- 10 + 11 |
release
@@ -2030,20 +2036,20 @@ ZAP MarketplaceZAP Crowdin Team |
- 2022-01-18 + 2025-08-21 | ||
- Help - Turkish
+ Help - Turkish
-
+
@@ -2054,7 +2060,7 @@ ZAP Marketplacehelp_tr_TR |
- 2 + 3 |
release
@@ -2063,7 +2069,7 @@ ZAP MarketplaceZAP Crowdin Team |
- 2022-01-18 + 2025-08-21 | - 5 + 7 | beta | - Jay Ball (veggiespam) and the ZAP Dev Team + Jay Ball (@veggiespam) and the ZAP Dev Team | - 2024-04-11 + 2025-09-18 | @@ -2177,7 +2183,7 @@- 0.13.0 + 0.15.0 |
beta
@@ -2199,7 +2205,7 @@ ZAP MarketplaceZAP Dev Team & thatsn0tmysite |
- 2025-01-09 + 2025-09-02 | @@ -2379,7 +2385,7 @@- 129 + 163 |
release
@@ -2401,7 +2407,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-03-11 + 2025-10-22 | @@ -2414,7 +2420,7 @@- 129 + 163 |
release
@@ -2436,7 +2442,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-03-11 + 2025-10-22 | @@ -2515,7 +2521,7 @@- 0.21.0 + 0.23.0 |
beta
@@ -2537,7 +2543,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-03-04 + 2025-09-02 | @@ -2550,7 +2556,7 @@- 0.21.0 + 0.22.0 |
beta
@@ -2572,7 +2578,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-01-09 + 2025-06-20 | @@ -2620,7 +2626,7 @@- 44 + 46 |
beta
@@ -2642,7 +2648,7 @@ ZAP MarketplaceZAP Dev Team plus Joanna Bona, Nathalie Bouchahine, Artur Grzesica, Mohammad Kamar, Markus Kiss, Michal Materniak, Marcin Spiewak, and SDA SE Open Industry Solutions |
- 2025-01-09 + 2025-09-10 | @@ -2690,7 +2696,7 @@- 0.2.0 + 0.5.0 |
alpha
@@ -2712,7 +2718,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-02-12 + 2025-09-10 | @@ -2725,7 +2731,7 @@- 63 + 68 |
release
@@ -2747,7 +2753,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-03-04 + 2025-10-21 | @@ -2760,7 +2766,7 @@- 44 + 46 |
alpha
@@ -2782,7 +2788,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-03-04 + 2025-09-18 | @@ -2795,7 +2801,7 @@- 43 + 46 |
beta
@@ -2817,7 +2823,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-03-04 + 2025-09-18 | @@ -2863,7 +2869,7 @@- 0.6.0 + 0.7.0 |
alpha
@@ -2885,7 +2891,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-02-03 + 2025-09-02 | @@ -2933,7 +2939,7 @@- 51 + 52 |
release
@@ -2955,7 +2961,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-01-10 + 2025-07-10 | @@ -3069,7 +3075,7 @@- 0.38.0 + 0.41.0 |
release
@@ -3091,7 +3097,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-03-04 + 2025-09-04 | @@ -3174,7 +3180,7 @@- 0.45.0 + 0.49.0 |
release
@@ -3196,7 +3202,7 @@ ZAP MarketplaceNikita Mundhada and the ZAP Dev Team |
- 2025-03-04 + 2025-09-18 | @@ -3209,7 +3215,7 @@- 9 + 10 |
release
@@ -3231,7 +3237,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-01-10 + 2025-06-20 | @@ -3244,7 +3250,7 @@- 5 + 6 |
alpha
@@ -3266,7 +3272,7 @@ ZAP MarketplaceZAP Dev Team |
- 2023-10-23 + 2025-06-20 | @@ -3345,7 +3351,7 @@- 0.2.0 + 0.5.0 |
alpha
@@ -3367,7 +3373,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-01-10 + 2025-09-18 | @@ -3380,7 +3386,7 @@- 45.8.0 + 45.14.0 |
release
@@ -3402,7 +3408,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-01-10 + 2025-10-07 | @@ -3415,7 +3421,7 @@- 15.35.0 + 15.41.0 |
release
@@ -3437,7 +3443,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-03-11 + 2025-10-21 | @@ -3520,7 +3526,7 @@- 24 + 28 |
beta
@@ -3542,7 +3548,40 @@ ZAP MarketplaceAlberto (albertov91) + ZAP Dev Team |
- 2025-01-10 + 2025-09-18 + | + + +
|
+
+ Software Risk Manager Extension
+
+
+
+
+
+
+
+
+
+ + Includes request and response data in XML reports and provides the ability to upload reports directly to a Software Risk Manager server + |
+ + srm + | ++ 2025.9.0 + | ++ alpha + | ++ Black Duck, Inc. + | ++ 2025-09-26 | - 0.13.0 + 0.16.0 |
release
@@ -3577,7 +3616,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-01-10 + 2025-09-02 | @@ -3623,7 +3662,7 @@- 21.45.0 + 21.48.0 |
release
@@ -3645,7 +3684,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-03-04 + 2025-09-02 | @@ -3658,7 +3697,7 @@- 14 + 15 |
beta
@@ -3680,7 +3719,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-01-10 + 2025-09-10 | @@ -3827,7 +3866,7 @@- 32 + 33 |
release
@@ -3849,7 +3888,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-01-10 + 2025-06-20 | @@ -3862,7 +3901,7 @@- 129 + 164 |
release
@@ -3884,7 +3923,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-03-11 + 2025-10-22 | @@ -3897,7 +3936,7 @@- 48.4.0 + 48.9.0 |
beta
@@ -3919,7 +3958,7 @@ ZAP MarketplaceZAP Dev Team |
- 2025-02-27 + 2025-09-02 | @@ -3980,7 +4019,7 @@+ + |
| XPath Injection | ++ |
- | - Links - | -|||
|---|---|---|---|
| - GitHub - | -- - https://github.com/anterosilva1985 - - | -||
| - LinkedIn - | -- - https://www.linkedin.com/in/antero-silva-580105a2/ - - | +Tag | +Link |
|---|---|---|---|
| Reverse Tabnabbing | ++ |
Antero is employed by Checkmarx as the Product Manager for ZAP, -Checkmarx DAST (which is built on ZAP) and -Kics.
-A SQL injection may be possible using the attached payload
+A SQL injection may be possible using the attached payload.
| + Details + | +|
|---|---|
| + Alert ID + | +90037 | +
| + Alert Type + | +Active | +
| + Status + | +release | +
| + + Risk + | +High | +
| + CWE + | ++ + 78 + + | +
| + WASC + | +31 | +
| + Technologies Targeted + | +
+
+
+ OS / Linux + + OS / MacOS + + OS / Windows + + + |
+
| + Tags + | +
+
+ CWE-78 + + HIPAA + + OWASP_2017_A01 + + OWASP_2021_A03 + + PCI_DSS + + POLICY_API + + POLICY_DEV_CICD + + POLICY_DEV_FULL + + POLICY_DEV_STD + + POLICY_PENTEST + + POLICY_QA_CICD + + POLICY_QA_FULL + + POLICY_QA_STD + + POLICY_SEQUENCE + + TEST_TIMING + + WSTG-V42-INPV-12 + + |
+
| + More Info + | +
+ Scan Rule Help + |
+
Attack technique used for unauthorized execution of operating system commands. This attack is possible when an application accepts untrusted input to build operating system commands in an insecure manner involving improper data sanitization, and/or improper calling of external programs.
+ +GET /JSON/ajaxSpider/action/setOptionClickDefaultElems/
Sets whether or not the the AJAX Spider will only click on the default HTML elements.
+Sets whether or not the AJAX Spider will only click on the default HTML elements.
++Code samples
+
# You can also use wget
+curl -X GET http://zap/JSON/ajaxSpider/action/setOptionEnableExtensions/?Boolean=true \
+ -H 'Accept: application/json'
+
+URL obj = new URL("http://zap/JSON/ajaxSpider/action/setOptionEnableExtensions/?Boolean=true");
+HttpURLConnection con = (HttpURLConnection) obj.openConnection();
+con.setRequestMethod("GET");
+int responseCode = con.getResponseCode();
+BufferedReader in = new BufferedReader(
+ new InputStreamReader(con.getInputStream()));
+String inputLine;
+StringBuffer response = new StringBuffer();
+while ((inputLine = in.readLine()) != null) {
+ response.append(inputLine);
+}
+in.close();
+System.out.println(response.toString());
+
+import requests
+headers = {
+ 'Accept': 'application/json'
+}
+
+r = requests.get('http://zap/JSON/ajaxSpider/action/setOptionEnableExtensions/', params={
+ 'Boolean': 'true'
+}, headers = headers)
+
+print(r.json())
+
+GET /JSON/ajaxSpider/action/setOptionEnableExtensions/
| Name | +In | +Type | +Required | +Description | +
|---|---|---|---|---|
| Boolean | +query | +boolean | +true | +none | +
++Example responses
+ +default Response
+
{
+ "code": "string",
+ "message": "string",
+ "detail": "string"
+}
+| Status | +Meaning | +Description | +Schema | +
|---|---|---|---|
| default | +Default | +Error of JSON endpoints. | +ErrorJson | +