CODEWITHSUNDEEP
owaspzap
Vineel Pellella
Vineel Pellella

Reputation: 422

How to analyze OWASP ZAP scan results effectively

How to analyze OWASP ZAP scan results effectively

After a run, I am getting a lot of URL's which are not vulnerabilities. Is there anyway that we can analyze the reports easily.

Upvotes: 1

Views: 2442

Answers (2)

Mate Mrše
Mate Mrše

Reputation: 8394

I propose a strategy:

  1. Run the scan
  2. Take the highest severity finding
  3. Read about it and check with development/other team members is is an issue or not
  4. Continue with the next finding on the list
  5. Repeat steps 2-4

After that, you will be able to eliminate or address most of the findings, so in the next iteration, you can exclude the non-issues from the scan.

Upvotes: 0

Simon Bennetts
Simon Bennetts

Reputation: 6186

The ZAP HTML report should only contain potential issues. If its including things that you think are not issues then you'll need to let us know what they are. Note that

Upvotes: 1

Related Questions