FAQtoplevel

Frequently Asked Questions (FAQ)

If you have any questions about ZAP that are not answered here or in the User Guide then please ask on the Developer Group or raise as an issue.

• Somethings not working. What should I do?
• Where can I ask ZAP related questions?
• What does ZAP test for?
• How do you configure ZAP to test an application on localhost?
• Why is ZAP not available in my language?
• How can I use the ZAP API in my own regression tests?
• Is there any danger when scanning with ZAP against a live website (e.g. create/delete/update/corrupt data)?
• How can I use ZAP with a Java application which connects to a web service over SSL?
• Where is ZAP installed?
• How can you start ZAP?
• What is the default directory that ZAP uses?
• What are the command line options?
• Can ZAP be used to test Windows 8 Metro apps?
• Can ZAP be used to test mobile apps?
• How can I add an application icon for ZAP to Fedora / Gnome 3?
• Why does ZAP 2.0.0 fail with "Unsupported major.minor version 51.0"?
• What should I do if ZAP doesn't detect a known problem?
• How can ZAP automatically authenticate via forms?
• How do you configure ZAP logging?
• Where does ZAP put its logs?
• What versions of Java are supported?
• How can you easily maximize a tab?
• How can you speed up scans?
• Why are there missing History Ids?
• What operating systems are supported?
• What vulnerability classifications are supported?
• Why am I getting blank ZAP windows on Linux?
• How do you add a script to ZAP from the command line?
• How do you find out what key to use to set a config value on the command line?
• How to connect to an HTTPS site that reports a handshake failure?
• Why has the Quick Scan Attack reported an invalid URL?
• How can ZAP test sites that use certificate pinning?
• Why is an API key created by default from ZAP 2.4.1?
• How can you use ZAP to scan APIs?
• How can I prevent ZAP from sending me 1000s of emails via a 'Contact Us' form?
• Why don't you rewrite ZAP in <my favorite language>?