Version 1.1.0 Documentation
ZAP Settings: Local Proxy Settings
ZAP Tools Options... Local Proxy
Configure the proxy host (e.g. 127.0.0.1
) and the proxy port (e.g. 9090
).
The host and port set here should be the SAME set in Firefox and in the ZAP Jenkins plugin.
Notice: This should be the IP address of the Slave (the machine where ZAP security tool is installed).
ZAP Settings: Database Settings
ZAP Tools Options... Database
Compact
Required: The database needs to be compacted of there will be issues with the closing and opening of large session files.
- Recovery Log
- Checked by default, keep as is.
- Database Size Vs. Available Memory
Increase the Java Heap Memory that the application is allowed to use. The amount you should allocate is:
<MAX_AVAILABLE_RAM> - 2GB
. This can be done byjvmopts
in zap.bat.
Notice: This is important and directly correlated to your database size. Due to a bug/feature/constraint with ZAP, it is only able to cleanly close your session's that are a maximum of 2GB less than you
<ALLOCATED_RAM>
. I have allocated 16GB of RAM to ZAP for use, ZAP can only cleanly close a session of 14GB. This means that you should have a one context to one session relationship.
ZAP Settings: Dynamic SSL Certificates Export
So, you've setup ZAP and are routing your browser's traffic through it and are ready to do some digging, but every time you hit a site, you get an annoying SSL Security Exception (Untrusted Connection) error and when you view the certificate, it is the OWASP ZAP Certificate.
You can of course, add the site to the exception list every single time but if you don't want to be annoyed by the constant SSL Exception Error prompts by your browser, you will need to add the OWASP ZAP Certificate to your list of certificates and recognize it as a Root CA.
Notice: Please be careful when manually adding certificates to your browser as it could be a huge security risk if you put in a key that is shared with other people or from an unknown source.
ZAP Tools Options... Dynamic SSL Certificates
- Generate
- Click on Generate if you don't see a certificate or if it's old and about to expire soon.
- Save
- Click on Save to export the certificate.
- OK
Once you successfully generated and exported a ZAP SSL certificate, you need to import the certificate into Firefox.
Attachments:
ZAP_SETTINGS.png (image/png)
ZAP_SETTINGS_PROXY.png (image/png)
ZAP_SETTINGS_PROXY.png (image/png)
ZAP_CERTIFICATE.png (image/png)
ZAP_CERTIFICATE.png (image/png)
ZAP_SETTINGS_PROXY.png (image/png)
ZAP_CERTIFICATE.png (image/png)
ZAP_SETTINGS_PROXY.png (image/png)
ZAP_CERTIFICATE.png (image/png)
ZAP_SETTINGS.png (image/png)