> For the complete documentation index, see [llms.txt](https://dev-angelist.gitbook.io/practical-ethical-hacker-ceh-tools/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dev-angelist.gitbook.io/practical-ethical-hacker-ceh-tools/practical-ethical-hacker-notes/tools/zap.md).

# Zap

https\://www\.zaproxy.org/docs/

#### Automated Web Site Scan

* put textbox URL to attack -> <http://testphp.vulnweb.com>
* check use traditional spider
* click on attack button

After scan, clicking on the Spider section we can see all URL/path of web site scanned.

While, clicking on the Alerts sections we ca see the vulnerabilities that're found and theirs relative methods (POST or GET):

* Absence of Anti-CSRF;
* SQL Injection.

{% embed url="<https://www.zaproxy.org/docs/>" %}

### Additional References:

{% embed url="<https://github.com/Samsar4/Ethical-Hacking-Labs/blob/master/10-Session-Hijacking/1-Using-ZAP.md>" %}
Using ZAP
{% endembed %}