False Negatives are where ZAP fails to identify an issue when it should.
Reporting these problems to us for passive scan rules is straightforward - just let us know the full request and/or response that ZAP should have raised the problem for.
Reporting problems with active scan rules is a bit more tricky, as ZAP will potentially send several requests to detect a specific problem and we need to know how your application responded to each one.
Ideally we would like a ZAP unit test which reproduces the problem. An example of one of these is TestCrossSiteScriptV2UnitTest.java However these are not easy for non programmers to write.
An alternative is to record a Zest script of the rule that you think should have detected the problem scanning the relevant URL:
Find the relevant URL in the Sites (or History) tree. This must correspond to the request that is actually vulnerable, i.e. it must have the same method (GET, PUT etc) and the correct parameter names. If you can’t find it then there is a problem exploring your application. This could be the way you are using ZAP or a problem with ZAP itself and is out of scope for this FAQ.
-
Right click the relevant URL and select ‘Attack / Active Scan…’
-
Check the ‘Show advanced options’ box if it is not already selected.
-
Select the ‘Policy’ tab.
-
Select: ‘Apply “OFF” Threshold to “All” Rules’ and click ‘Go’.
-
Find the rule you want to test in the relevant category and change its Threshold to ‘Default’ by clicking on it in the table.
-
Click ‘Start Scan’. You should now see one or more requests in the ‘Active Scan’ tab.
-
Select all of the requests in the ‘Active Scan’ tab, e.g. by clicking the first, then clicking the last with the shift key pressed.
-
Right click and select ‘Add to Zest Script -> New Zest Script…’
-
Give the script a suitable title and ‘Save’. You should now see the new script in the ‘Scripts’ tab and the ‘Script Console’ tab.
-
Right click the top panel in the ‘Script Console’ tab and select ‘Select All’.
-
Right click again and select ‘Copy’.
You can now paste this script into an issue, email, ZAP group post etc.
If the script contains sensitive information then prior to performing ‘Select All’:
-
Find the relevant strings in the Zest requests or responses
-
Highlight them
-
Right click and select ‘Redact text…’
-
Press ‘Save’. If you leave the default ‘Apply to all current requests’ box checked then you will only need to do this once per string.