What you'll learn

Scans using default settings rarely fit the application in front of you. They run too long, attack things you do not own, and bury real findings under false positives. In this course, Customization with ZAP, you’ll learn to tailor ZAP to a specific target so your scans are faster and more accurate. First, you’ll explore how to build and tune scan policies, adjusting alert thresholds, attack strength, and performance settings to control what ZAP tests and how hard it hits. Next, you’ll discover how to control scan scope using contexts, include and exclude rules, and regular expressions that keep third-party and static content out of your results. Finally, you’ll learn how to analyze the alerts, filtering by confidence and evidence, suppressing verified false positives, and documenting your rationale. When you’re finished with this course, you’ll have the skills and knowledge of ZAP customization needed to deliver targeted and defensible web application scans.