ZAP Passive Scanning

Play an AI-generated podcast conversation about this lesson

What is the main objective of active scanning in ZAP?

To review results of a scan

To attempt to find potential vulnerabilities by using known attacks (correct)

To identify logical vulnerabilities in a web application

To capture and iterate through websites

What is the purpose of Scan Policies in ZAP?

To configure active scanning rules (correct)

To review results of a scan

To set up passive scanning rules

To add authentication to a scan

What is a limitation of active scanning in ZAP?

It can only scan web applications that you own

It can only find certain types of vulnerabilities (correct)

It can find all types of vulnerabilities, including logical ones

It does not require any configuration

How is active scanning configured in ZAP?

Using the Options Active Scan screen Signup and view all the answers

What is the purpose of passive scanning in ZAP?

To identify potential vulnerabilities without attacking the target Signup and view all the answers

What is NOT a feature of ZAP?

Automated tagging Signup and view all the answers

What is the primary purpose of passive scanning in ZAP?

To scan all HTTP messages sent to the web application Signup and view all the answers

What is configured using the Options Passive Scan Tags screen?

The rules for automatic tagging Signup and view all the answers

What is a limitation of passive scanning in ZAP?

It cannot discover pages protected by a login page Signup and view all the answers

What can be configured using the Options Passive Scan Rules screen?

The alerts raised by passive scanners Signup and view all the answers

What is the main benefit of passive scanning in ZAP?

It is safe to use and does not slow down the exploration of an application Signup and view all the answers

What is the primary difference between passive scanning and manual exploration in ZAP?

Passive scanning has limitations in discovering pages protected by a login page Signup and view all the answers

What is a limitation of solely relying on spiders for vulnerability scanning?

They may not find all resources on a site, especially hidden pages Signup and view all the answers

What is the benefit of using a browser to explore a web application with ZAP proxying?

It allows ZAP to passively scan for vulnerabilities and build the site tree Signup and view all the answers

What is the primary purpose of a spider in ZAP?

To automatically discover new resources on a site Signup and view all the answers

What is a key concept in web application security that is related to hidden pages?

Obscurity is not security Signup and view all the answers

How is a spider typically started in ZAP?

With a list of URLs to visit, called the seeds Signup and view all the answers

What is the result of ZAP's passive scanning during manual exploration of a web application?

A record of alerts for potential vulnerabilities found Signup and view all the answers