Release 2.8.0

This is a bug fix and enhancement release, which requires a minimum of Java 8. Note that a minimum of Java 11 is recommended, especially for high DPI displays.

These release notes do not include all of the changes included in add-ons updated since 2.7.0.

Some of the more significant enhancements include:

Heads Up Display

The ZAP Heads Up Display (HUD) brings all of the essential ZAP functionality into your browser. It is ideal for people new to web security and also allows experienced penetration testers to focus on an application's features while providing key security information and functionality.
The HUD can be enabled when proxying a browser through ZAP via the new 'Manual Explore' screen and a top level toolbar button.

Quick Start Screens

The Quick Start tab has been reworked to provide 3 screens: The tab also provides a news panel that provides a summary of ZAP news along with a link for more details. News items can be hidden when no longer needed.

Scan Rule Promotions

The following scan rules have been promoted:

Active Scan Rules - Release

Passive Scan Rules - Release

Headless Browser Support

Headless browsers are now supported by the Selenium add-on and the add-ons that use it. Both the Ajax Spider and the DOM XSS scan rule now default to headless Firefox.

Command Line Changes

-dir <dir>

To prevent add-ons (inadvertently) use/override core files ZAP will no longer start (and show an error) if the home and the installation directories are the same.

CA Certificate Handling

The following options allow the root CA certificate to be set and read: 
-certload <path>      Loads the Root CA certificate from the specified file name
-certpubdump <path>   Dumps the Root CA public certificate into the specified file name, this is suitable for importing into browsers
-certfulldump <path>  Dumps the Root CA full certificate (including the private key) into the specified file name, this is suitable for importing into ZAP
These options are particularly useful when running ZAP headless in Docker, as they allow you to either specify the CA certificate to use or to access the one that ZAP creates automatically for you.

Client Certificate Handling

It is now possible to set the Client Certificate from the command line with the following switches: 
-config certificate.use=true
-config certificate.pkcs12.path=/path/to/file.p12
-config certificate.pkcs12.password=WhateverThePasswordIs
-config certificate.pkcs12.index=1
-config certificate.persist=true

-config certificate.pkcs12.index is only necessary if the file contains multiple certificates and you wish to use one other than the first. Index values start at zero (0) which is the first certificate in the file.

-config certificate.persist=true is only necessary if you would like the settings persisted in ZAP's regular configuration file (so that they apply for subsequent ZAP use).

Source Code Restructuring

The ZAP repositories have all been migrated to use Gradle from Ant. Standard source code formatting is also now enforced for consistency.

Filters Removal

Deprecated since ZAP 2.4.0 the Filters functionality, that allowed to change/access some HTTP messages sent/received through ZAP, has now been removed, the same and much more can be achieved with scripts and Replacer add-on.

Changes in Bundled Libraries

The following libraries are no longer being bundled with ZAP (core): The following libraries will be removed in a future release: no longer in use by core, add-ons should bundle the library, if needed. The following libraries were updated:

Active Scan Input Vectors Change

Users now have the option of whether or not to add a query parameter to GET requests that did not have them to start with. In previous versions this behavior was not user controllable and was on by default. With the new user option the default has been changed to off.

JSON Authentication Method

An authentication method has been added which allows a JSON object to be sent in the request body.

JSON Report Change

For consistency the site property will be always an array regardless of the number of sites that the report contains, previously it would be an object if only one site and an array if more than one.

Display Options - Font Controls

In the Options dialog Display panel it is now possible for the user to select a General font and size for ZAPs GUI, as well as a Work Panel font and size used for the top right section of ZAP's main window (Ex: Request/Response, the Edit and Resend tool, etc.).

Enhancements

Bug fixes

ZAP API Breaking Changes:

VIEW acsrf / optionTokensNames

This change will break the consumers that were manually parsing/extracting the names from the string. The structure of the data returned was changed to properly separate each name: 

{"optionTokensNames":["anticsrf","CSRFToken"]}
and: 

<optionTokensNames type="list">
    <tokenName>anticsrf</tokenName>
    <tokenName>CSRFToken</tokenName>
</optionTokensNames>
instead of: 

{"TokensNames":"[anticsrf, CSRFToken]"}
and: 

<optionTokensNames>[anticsrf, CSRFToken]</optionTokensNames>

VIEW authentication / getAuthenticationMethod

This change will break the consumers that were manually parsing/extracting the JSON response (and XML response, for manual authentication method). The structure of the data was changed to have an object wrap the authentication method data, to be consistent with all other views. The returned data would be, for example: 

{
  "method": {
    "port": "443",
    "host": "example.com",
    "methodName": "httpAuthentication",
    "realm": "example"
  }
}
instead of: 

{
  "port": "443",
  "host": "example.com",
  "methodName": "httpAuthentication",
  "realm": "example"
}

VIEW core / alertsSummary

This change will break the consumers that were manually parsing/extracting the JSON response. The structure of the data was changed to have an object wrap the alerts summary, to be consistent with all other views. The returned data would be, for example: 

{
  "alertsSummary": {
    "High": 0,
    "Low": 3,
    "Medium": 1,
    "Informational": 1
  }
}
instead of: 

{
  "High": 0,
  "Low": 3,
  "Medium": 1,
  "Informational": 1
}

VIEW core / alerts

The view will now validate the risk ID, returning an error (ILLEGAL_PARAMETER) if not valid.

VIEW core / numberOfAlerts

The view will now validate the risk ID, returning an error (ILLEGAL_PARAMETER) if not valid.

ZAP API Deprecated Endpoints:

All alert related core endpoints were deprecated, they are now accessible through a new component alert.

ZAP API Changed Endpoints:

ACTION authentication / setAuthenticationMethod

The action will no longer remove existing users, instead the user is disabled and its credentials reset if the type of credentials of the authentication method being set is different.

ACTION context / excludeContextTechnologies

The action will now accept the string with technologies even if there are spaces before or after the names, for example: 

os.linux, db.mysql
will now be valid.

ACTION context / includeContextTechnologies

The action will now accept the string with technologies even if there are spaces before or after the names, for example: 

os.linux, db.mysql
will now be valid.

ACTION core / snapshotSession

Added optional parameters name and overwrite, to allow to specify a name and overwrite existing files.

ZAP API New Endpoints:

View ascan / optionAddQueryParam

Tells whether or not the active scanner should add a query parameter to GET request that don't have parameters to start with.

VIEW autoupdate / localAddons

Returns a list with all local add-ons, installed or not.

VIEW context / urls

Lists the URLs accessed through/by ZAP, that belong to the context with the given name.

VIEW httpSessions / defaultSessionTokens

Gets the default session tokens.

VIEW pscan / maxAlertsPerRule

Gets the maximum number of alerts a passive scan rule should raise.

VIEW script / globalVar

Gets the value of the global variable with the given key. Returns an API error (DOES_NOT_EXIST) if no value was previously set.

VIEW script / globalVars

Gets all the global variables (key/value pairs).

VIEW script / listTypes

Lists the script types available.

VIEW script / scriptVar

Gets the value of the variable with the given key for the given script. Returns an API error (DOES_NOT_EXIST) if no script with the given name exists or if no value was previously set.

VIEW script / scriptVars

Gets all the variables (key/value pairs) of the given script. Returns an API error (DOES_NOT_EXIST) if no script with the given name exists.

ACTION ascan / setOptionAddQueryParam

Sets whether or not the active scanner should add a query param to GET requests which do not have parameters to start with.

ACTION core / enablePKCS12ClientCertificate

Enables use of a PKCS12 client certificate for the certificate with the given file system path, password, and optional index.

ACTION core / disableClientCertificate

Disables the option for use of client certificates.

ACTION httpSessions / addDefaultSessionToken

Adds a default session token with the given name and enabled state.

ACTION httpSessions / removeDefaultSessionToken

Removes the default session token with the given name.

ACTION httpSessions / setDefaultSessionTokenEnabled

Sets whether or not the default session token with the given name is enabled.

ACTION pscan / setMaxAlertsPerRule

Sets the maximum number of alerts a passive scan rule should raise.

ACTION script / clearGlobalVar

Clears the global variable with the given key.

ACTION script / clearGlobalVars

Clears the global variables.

ACTION script / clearScriptVar

Clears the variable with the given key of the given script. Returns an API error (DOES_NOT_EXIST) if no script with the given name exists.

ACTION script / clearScriptVars

Clears the variables of the given script. Returns an API error (DOES_NOT_EXIST) if no script with the given name exists.

ACTION script / setGlobalVar

Sets the value of the global variable with the given key.

ACTION script / setScriptVar

Sets the value of the variable with the given key of the given script. Returns an API error (DOES_NOT_EXIST) if no script with the given name exists.

See also

    Introductionthe introduction to ZAP
    Releasesthe full set of releases
    Creditsthe people and groups who have made this release possible