Scanning a web app actively
An active scan is as it sounds. ZAP will attempt to locate, fuzz, and enumerate an application based on known vulnerabilities and exploit them. Active scanning is explicitly an attack on a web application.
Important note
Do not scan web applications that you do not have permission to test.
Important note
Active scans will not account for business logic vulnerabilities. You will need to test these manually.
A feature to keep in mind in ZAP is a script that can be added to the headers for all traffic passing through, which will aid in identifying ZAP traffic and web application firewall (WAF) exceptions. The script is AddZAPHeader.js, which adds a header (i.e., X-ZAP-Initiator: 3). If you are using Windows, the default install location is in the following path: C:\Program Files\OWASP\Zed Attack Proxy\scripts\templates\httpsender.
Note that new HttpSender scripts will initially be disabled. Right-click the script in the Scripts tree and select...
