Configuration File Structure

maxAlertsPerRule:

Maximum number of alerts to raise per rule

Int, default: 10

scanOnlyInScope:

Only scan URLs in scope

Bool, default: true

maxBodySizeInBytesToScan:

Maximum body size to scan

Int, default: 0 - will scan all messages

enableTags:

Enable passive scan tags, default: false - enabling them can impact performance

Bool, default: false

disableAllRules:

If true then will disable all rules before applying the settings in the rules section

Bool, default: false

rules:

A list of one or more passive scan rules and associated settings which override the defaults

id:

The rule id

Int

name:

The name of the rule for documentation purposes - this is not required or actually used

String

threshold:

The Alert Threshold for this rule

String, default: medium

one of Off, Low, Medium, High

context:

The context mentioned in ENV:

String

user:

An optional user to use for authentication must be defined in the env

String, inherited from Context

url:

URL to start spidering

String, inherited from Context

maxDuration:

Maximum duration time for spider analysis; it will impact the duration of the scan and should reflect the goal of the DAST scan

Integer, default: 0 unlimited

maxCrawlDepth:

At maximum depth of analysis, the spider will continue following links when crawling the application; it will impact the duration of the scan and should reflect the goal of the DAST scan

Integer, default: 10, 0 is unlimited

numberOfBrowsers:

The number of browsers the spider will use, more will be faster but will use up more memory

Integer, default: 1

runOnlyIfModern:

If true then the spider will only run if a "modern app" alert is raised; it is recommended to force the spider by setting it to false

Boolean, default: false

inScopeOnly:

If true then any URLs requested which are out of scope will be ignored; for microservices / multi-endpoint applications the setting should be set to false

Boolean, default: true

browserId:

Browser Id to use

String, default: firefox-headless

clickDefaultElems:

When enabled only click the default element: 'a', 'button', and 'input'; to be modified only for specific scenarios of spidering applications that are more complex in terms of Ajax interactions

Boolean, default: true

clickElemsOnce:

When enabled only click each element once; to be modified only for specific scenarios of spidering applications that are more complex in terms of Ajax interactions

Boolean, default: true

eventWait:

The time in milliseconds to wait after a client-side event is fired

Integer, default: 1000

maxCrawlStates:

The maximum number of crawl states the crawler should crawl

Integer, default: 0 unlimited

randomInputs:

When enabled random values will be entered into the input element

Boolean, default: true

reloadWait:

The time in milliseconds to wait after the URL is loaded

Integer, default: 1000

elements:

A list of HTML elements to click - will be ignored unless clickDefaultElems is false

It represents the HTML element LINK

It represents the HTML element Button

It represents the HTML element Input

maxDuration:

Max time to wait for the passive scanner

Int, default: 0 unlimited

apiFile:

The local file containing the OpenAPI definition

String, null, no definition will be imported

Context:

Context to use when importing the OpenAPI definition

String, null, no context will be used

targetUrl:

URL which overrides the target defined in the definition

String, null, the target will not be overridden

context:

String: Name of the context to attack

String, default: first context

user:

String: An optional user to use for authentication, must be defined in the environment

String

policy:

String: Name of the scan policy to be used

String, default: Default Policy

maxRuleDurationInMins:

Int: The max time in minutes any individual rule will be allowed to run for

Int, default: 0 unlimited

maxScanDurationInMins:

Int: The max time in minutes the active scanner will be allowed to run for

Int, default: 0 unlimited

addQueryParam:

Bool: If set will add an extra query parameter to requests that do not have one

Bool, default: false

defaultPolicy:

String: The name of the default scan policy to use.

String, default: Default Policy

delayInMs:

Int: The delay in milliseconds between each request, used to reduce the strain on the target

Int, default 0

handleAntiCSRFTokens:

Bool: If set, automatically handles anti-CSRF tokens

Bool, default: false

injectPluginIdInHeader:

If set, the relevant rule Id will be injected into the X-ZAP-Scan-ID header of each request,

Bool

scanHeadersAllRequests:

Bool: If set then the headers of requests that do not include any parameters will be scanned,

Bool, default: false

threadPerHost:

Int: The max number of threads per host

Int, default: 2

policyDefinition:

The policy definition - is only used if the 'policy' is not set

defaultStrength:

The default Attack Strength for all rules is either Low, Medium, High, or Insane (not recommended).

String

defaultThreshold:

String: The default Alert Threshold for all rules, is either Off, Low, Medium, or High.

String, default: Medium

rules:

A list of one or more active scan rules and associated settings which override the defaults.

id:

Int: The rule id as per https://www.zaproxy.org/docs/alerts/

name:

String: The name of the rule for documentation purposes - this is not required nor actually used.

String

strength:

The Attack Strength for this rule is either Low, Medium, High, or Insane.

String, default: Medium

threshold:

The Alert Threshold for this rule, is either Off, Low, Medium, or High.

String, default: Medium

template:

The template id

String, default: traditional-html

reportDir:

The directory into which the report will be written

String

reportFile:

The report file name pattern

String, default: {{yyyy-MM-dd}}-ZAP-Report-[[site]]

reportTitle:

The report title

String

reportDescription:

The report description

String

displayReport:

Display the report when generated

Boolean, default: false

risks:

The risks to include in this report

List, default: all

confidences:

The confidences to include in this report

List, default: all

sections:

The template sections to include in this report - see the relevant template

List, default all