1. Documentation
2. The ZAP by Checkmarx Desktop User Guide
3. Add-ons
4. Spider
5. Spider tab

Spider tab

The Spider tab shows you the set of unique URIs found by the Spider during the scans.

The ‘New Scan’ button launches the Spider dialog which allows you to specify exactly what should be scanned.

The Spider can be run on multiple Sites in parallel and the results for each scan are shown by selecting the scan via the ‘Progress’ pull-down.

The toolbar shows information about a scan and allows to control it. It provides a set of buttons which allows to:

• Pause (and resume) the selected Spider scan;
• Stop the selected Spider scan;
• Clean completed scans;
• Open the Spider Options screen.

The progress bar shows how far the selected Spider scan has progressed. It is also shown the number of active Spider scans and the number of URIs found for the selected scan.

For each URI found you can see:

• Processed - Whether the URI was processed by the Spider or was skipped from fetching because of a rule. Skipped reasons include:
  • Out of Context - the message was not part of the targetted context
  • Out of Scope - the message was not in scope
  • Illegal Protocol - the message was neither HTTP nor HTTPS
  • User Rules - the message was skipped due to user defined exclude
  • Logout Avoidance - the message was skipped because the user indicated that logout related paths/functionality should be avoided
• Method - The HTTP method, e.g. GET or POST, through which the resource should be accessed
• URI - the resource found
• Flags - any information about the URI (e.g. if it’s a seed or why was it not processed)

For each Spider message, shown under the Messages tab, you can see details of the request sent and response received. The Processed column, indicates whether:

• Successfully - the response was successfully received and parsed
• Empty Message - the response was not parsed because it was empty
• I/O Error - an input/output error occurred while fetching the response
• Max Children - the response was not parsed because the corresponding parent Sites node already has more child nodes than the maximum allowed
• Max Depth - the response was not parsed because it passed the maximum depth allowed
• Max Size - the response was not parsed because its size is not under the maximum allowed
• Not Text - the response was not parsed because it’s not text, for example, an image
• Spider Stopped - the response was not fetched or parsed because the Spider was already stopped

See also