Skip to content

Commit

Permalink
Update links and some content
Browse files Browse the repository at this point in the history
Link directly to new help pages to avoid unnecessary hops.
Update FAQ content to use new option name.

Signed-off-by: thc202 <[email protected]>
  • Loading branch information
thc202 committed Oct 27, 2023
1 parent b396fa7 commit ecde8e8
Show file tree
Hide file tree
Showing 12 changed files with 20 additions and 20 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ A new set of environmental variables are available which allow you to easily add
These are documented on the [Authentication](/docs/desktop/start/features/authentication/#envvars) page.

### SOCKS Proxy Configuration
It is now possible to dynamically configure the outgoing SOCKS proxy in the [Options' Connection screen](/docs/desktop/ui/dialogs/options/connection/).
It is now possible to dynamically configure the outgoing SOCKS proxy in the [Options' Connection screen](/docs/desktop/addons/network/options/connection/).
By default the SOCKS proxy configuration applies to all connections made by ZAP.

### Cached Scripts
Expand All @@ -80,7 +80,7 @@ The following add-ons are included by default in this release for the first time

* [Advanced Encode / Decode / Hash dialog](/docs/desktop/addons/encode-decode-hash/) - this replaces the old core encode/decode/hash dialog
* [DOM XSS Scan Rule](/docs/desktop/addons/dom-xss-active-scan-rule/) - an Active Scan rule for detecting DOM XSS vulnerabilities
* [Form Handler](/docs/desktop/addons/form-handler/) - allows for the custom configuration of values used in forms based on field names
* [Form Handler](/docs/desktop/addons/value-generator/) - allows for the custom configuration of values used in forms based on field names
* [GraalVM JavaScript](/docs/desktop/addons/graalvm-javascript/) - included as Java 15+ no longer includes the Oracle Nashorn JavaScript engine
* [GraphQL Support](/docs/desktop/addons/graphql-support/) - allows you to import and active scan GraphQL definitions
* [Retire.js](/docs/desktop/addons/retire.js/) - a Passive Scan rule which implements checks provided by [Retire.js](https://retirejs.github.io/retire.js/) in order to identify vulnerable or out-dated JavaScript packages
Expand Down
2 changes: 1 addition & 1 deletion site/content/blog/2022-05-10-the-requester-addon/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ Once you have it installed you will see a new Requester tab next to the standard
![Requester Tab](images/requester.png)


The new tab is like the built in [Manual Request Editor](/docs/desktop/ui/dialogs/man_req/) dialog but it also supports any number of Request/Response tabs.
The new tab is like the built in [Manual Request Editor](/docs/desktop/addons/requester/dialogs/) dialog but it also supports any number of Request/Response tabs.

While you can create requests from scratch you will find it much easier to right click on existing requests in any of the other ZAP tabs and select "Open in Requester Tab..." - the request will then open in a new Requester tab.
You can also use the Control / Command + "W" key to do the same thing via the keyboard.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ If you use ZAP via these companies please get in touch with them and ask them ho

### Form Handler RegEx Support
You can now match parameters names in HTTP requests using regular expressions using the
[Form Handler](/docs/desktop/addons/form-handler/) add-on.
[Form Handler](/docs/desktop/addons/value-generator/) add-on.


### Automation Framework Job Times
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ If you need to set up ZAP to handle authentication then you really need to find

You should always try [Auto Detection](../auto-detection) first as if this works it will find a suitable verification URL for you.

The verification URL will be one that you can request from the [Manual Request Editor dialog](/docs/desktop/ui/dialogs/man_req/) and which will send a response that allows you to work out whether you are logged in or not. What that looks like will entirely depend on your app, but could be something like:
The verification URL will be one that you can request from the [Manual Request Editor dialog](/docs/desktop/addons/requester/dialogs/) and which will send a response that allows you to work out whether you are logged in or not. What that looks like will entirely depend on your app, but could be something like:

* Any page or API endpoint which returns the authenticated user's Id
* A user details page or API endpoint
Expand Down
4 changes: 2 additions & 2 deletions site/content/docs/authentication/session-handling.md
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ If used in conjunction with [Browser Based Authentication](/docs/desktop/addons/

If you can see any `Set-Cookie` headers being returned then it is likely that your app is using cookie-based session management.

Make a request to your [verification URL](../finding-a-verification-url/) while authenticated and then open that request in the [Manual Request Editor dialog](/docs/desktop/ui/dialogs/man_req/).
Make a request to your [verification URL](../finding-a-verification-url/) while authenticated and then open that request in the [Manual Request Editor dialog](/docs/desktop/addons/requester/dialogs/).

Check that there is a `Cookie` header in the request and that when you `Send` the request then it indicates you are logged in.

Expand All @@ -53,7 +53,7 @@ Configure your context to use this - you do not need any other configuration, su

If you see a `WWW-Authenticate` response header and then a `Authorization` header then your app is using [HTTP Authentication](https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication).

As above, make a request to your [verification URL](../finding-a-verification-url/) while authenticated and then open that request in the [Manual Request Editor dialog](/docs/desktop/ui/dialogs/man_req/).
As above, make a request to your [verification URL](../finding-a-verification-url/) while authenticated and then open that request in the [Manual Request Editor dialog](/docs/desktop/addons/requester/dialogs/).

Check that there is an `Authorization` header in the request and that when you `Send` the request then it indicates you are logged in.

Expand Down
2 changes: 1 addition & 1 deletion site/content/docs/desktop/releases/2.10.0.md
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ The following add-ons are included by default in this release for the first time

* [Advanced Encode / Decode / Hash dialog](/docs/desktop/addons/encode-decode-hash/) - this replaces the old core encode/decode/hash dialog
* [DOM XSS Scan Rule](/docs/desktop/addons/dom-xss-active-scan-rule/) - an Active Scan rule for detecting DOM XSS vulnerabilities
* [Form Handler](/docs/desktop/addons/form-handler/) - allows for the custom configuration of values used in forms based on field names
* [Form Handler](/docs/desktop/addons/value-generator/) - allows for the custom configuration of values used in forms based on field names
* [GraalVM JavaScript](/docs/desktop/addons/graalvm-javascript/) - included as Java 15+ no longer includes the Oracle Nashorn JavaScript engine
* [GraphQL Support](/docs/desktop/addons/graphql-support/) - allows you to import and active scan GraphQL definitions
* [Retire.js](/docs/desktop/addons/retire.js/) - a Passive Scan rule which implements checks provided by [Retire.js](https://retirejs.github.io/retire.js/) in order to identify vulnerable or out-dated JavaScript packages
Expand Down
6 changes: 3 additions & 3 deletions site/content/docs/guides/zapping-the-top-10-2017.md
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ The component links take you to the relevant places in an online version of the
|--|--|--|
| {{< heading level="5" heading="Common Components" >}} | | The 'common components' can be used for pretty much everything, so can be used to help detect all of the Top 10 |
| | Manual | [Manipulator-in-the-middle proxy](/docs/desktop/start/features/intercept/) |
| | Manual | [Manual request](/docs/desktop/ui/dialogs/man_req/) / resend |
| | Manual | [Manual request](/docs/desktop/addons/requester/dialogs/) / resend |
| | Manual | [Scripts](/docs/desktop/addons/script-console/) |
| | Manual | [Search](/docs/desktop/ui/tabs/search/) |
| [{{< heading level="5" heading="A1 Injection" >}}](https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A1-Injection) | | |
Expand All @@ -33,7 +33,7 @@ The component links take you to the relevant places in an online version of the
| | Manual | [Fuzzer](/docs/desktop/addons/fuzzer/), combined with the [FuzzDb*](/docs/desktop/addons/fuzzdb-files/) and [SVN Digger*](/docs/desktop/addons/svn-digger-files/) files |
| [{{< heading level="5" heading="A2 Broken Authentication" >}}](https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A2-Broken_Authentication) | | |
| | Manual | [HTTP Sessions](/docs/desktop/start/features/httpsessions/) |
| | Manual | [Spider](/docs/desktop/start/features/spider/) |
| | Manual | [Spider](/docs/desktop/addons/spider/) |
| | Manual | [Forced Browse](/docs/desktop/addons/forced-browse/) |
| | Manual | [Token Generator*](/docs/desktop/addons/token-generator/) |
| | Automatic | [Access Control Testing*](/docs/desktop/addons/access-control-testing/) |
Expand All @@ -50,7 +50,7 @@ The component links take you to the relevant places in an online version of the
| | Manual | [Port Scanner*](/docs/desktop/addons/port-scan/) |
| | Manual | [Wappalyzer - Technology detection*](/docs/desktop/addons/technology-detection/) |
| [{{< heading level="5" heading="A6 Security Misconfiguration" >}}](https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A6-Security_Misconfiguration) | | |
| | Manual | [Spider](/docs/desktop/start/features/spider/) |
| | Manual | [Spider](/docs/desktop/addons/spider/) |
| | Manual | [Ajax Spider](/docs/desktop/addons/ajax-spider/) |
| | Manual | [Session comparison](/docs/desktop/ui/tlmenu/report/#compare-with-another-session) |
| | Manual | [Access Control Testing*](/docs/desktop/addons/access-control-testing/) |
Expand Down
6 changes: 3 additions & 3 deletions site/content/docs/guides/zapping-the-top-10-2021.md
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ The component links take you to the relevant places in an online version of the
|--|--|--|
| {{< heading level="5" heading="Common Components" >}} | | The 'common components' can be used for pretty much everything, so can be used to help detect all of the Top 10 |
| | Manual | [Manipulator-in-the-middle proxy](/docs/desktop/start/features/intercept/) |
| | Manual | [Manual request](/docs/desktop/ui/dialogs/man_req/) / resend |
| | Manual | [Manual request](/docs/desktop/addons/requester/dialogs/) / resend |
| | Manual | [Scripts](/docs/desktop/addons/script-console/) |
| | Manual | [Community Scripts](/docs/desktop/addons/community-scripts/) |
| | Manual | [Search](/docs/desktop/ui/tabs/search/)
Expand All @@ -45,7 +45,7 @@ The component links take you to the relevant places in an online version of the
| | Automated | Scan Rules tagged with: [OWASP_2021_A04](/alerttags/owasp_2021_a04/) |
| [{{< heading level="5" heading="A5 Security Misconfiguration" >}}](https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2021/Top_10-2021_A5-Security_Misconfiguration) | | |
| | Automated | Scan Rules tagged with: [OWASP_2021_A05](/alerttags/owasp_2021_a05/) |
| | Manual | [Spider](/docs/desktop/start/features/spider/) |
| | Manual | [Spider](/docs/desktop/addons/spider/) |
| | Manual | [Ajax Spider](/docs/desktop/addons/ajax-spider/) |
| | Manual | [Session comparison](/docs/desktop/ui/tlmenu/report/#compare-with-another-session) |
| | Manual | [Access Control Testing*](/docs/desktop/addons/access-control-testing/) |
Expand All @@ -54,7 +54,7 @@ The component links take you to the relevant places in an online version of the
| | Manual | [Wappalyzer - Technology detection*](/docs/desktop/addons/technology-detection/) |
| [{{< heading level="5" heading="A7 Identification and Authentication Failure" >}}](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/) | | |
| | Manual | [HTTP Sessions](/docs/desktop/start/features/httpsessions/) |
| | Manual | [Spider](/docs/desktop/start/features/spider/) |
| | Manual | [Spider](/docs/desktop/addons/spider/) |
| | Manual | [Forced Browse](/docs/desktop/addons/forced-browse/) |
| | Manual | [Token Generator*](/docs/desktop/addons/token-generator/) |
| | Automated | [Access Control Testing*](/docs/desktop/addons/access-control-testing/) |
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ are a couple of things you need to be aware of.
By default ZAP listens on port 8080. If your app also listens on 8080 then
you'll need to change one of them to listen on a different port - it's probably
easier to change ZAP using the [Options Local
Proxies](/docs/desktop/ui/dialogs/options/localproxy/) screen, remember to change your
Proxies](/docs/desktop/addons/network/options/localservers/) screen, remember to change your
browser's proxy settings as well: [Configuring Proxies](/docs/desktop/start/proxies/).

You also need to check that you have not configured your browser to ignore
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ First of all try checking the 'Enable unsafe SSL/TLS renegotiation' checkbox
in the Certificate Options screen and trying again.

Second check if you've enabled SSLv2Hello in the outbound [connection
options](/docs/desktop/ui/dialogs/options/connection/). If so, disable SSLv2Hello and
options](/docs/desktop/addons/network/options/connection/). If so, disable SSLv2Hello and
reload the content to see if the issue is resolved.

If this doesn't help and an HTTPS site reports a handshake failure then try
Expand Down Expand Up @@ -50,7 +50,7 @@ Solution(s): Disable RC4 on the server.

If you're in a corporate or business environment that normally requires the
use of an Enterprise proxy you can have ZAP use it as well via the [Options :
Connections screen](/docs/desktop/ui/dialogs/options/connection/). If ZAP can't actually get to the
Connections screen](/docs/desktop/addons/network/options/connection/). If ZAP can't actually get to the
destination (because use of the corporate proxy is required) this can
sometimes manifest as an SSL/TLS negotiation failure.

Expand Down
4 changes: 2 additions & 2 deletions site/content/faq/what-options-exist-for-selective-proxying.md
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,9 @@ There are a number of ways to accomplish selective proxying.

* Such as FoxyProxy: <https://getfoxyproxy.org/>

#### 2 - Via Global Excludes
#### 2 - Via Global Exclusions

* Leveraging [Global Excludes](/docs/desktop/start/features/globalexcludeurl/) you can specify URLs that ZAP should not intercept.
* Leveraging [Global Exclusions](/docs/desktop/addons/network/options/globalexclusions/) you can specify URLs that ZAP should not intercept.

#### 3 - Via a PAC (Proxy Auto-Config) File

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ If the Quick Start Attack fails with the message:
then the first thing to do is check your URL in a browser.

If it works ok then open the ZAP [Manual Request
Editor](/docs/desktop/ui/dialogs/man_req/),
Editor](/docs/desktop/addons/requester/dialogs/),
replace the default URL with the one you are trying and send the request.

The response may well explain the problem.
Expand Down

0 comments on commit ecde8e8

Please sign in to comment.