ZAP passively scans all of the responses from the web application being tested. Passive scanning does not change the responses in any way and is therefore safe to use. Scanned is performed in a background thread to ensure that it does not slow down the exploration of an application.

In this release ZAP passive scanning is used for automatically adding tags and raising alerts for potential issues.

Passive scanning is configured using the Options Passive Scan screen. A set of rules for automatic tagging are provided by default. These can be changed, deleted or added to.

Passive Scan

See also