ZAP Deep Dive: The ZAP 2.9.0 Desktop Interface

### Overview In this StackHawk training session, OWASP ZAP founder and project lead Simon Bennetts provides a detailed walkthrough of the OWASP ZAP 2.9.0 desktop interface. Bennetts explains that even for automated pipelines or headless daemon setups, understanding the desktop interface is critical because the UI directly reflects ZAP's underlying data structures, configurations, and API behavior. The session covers core interface navigation, layout customizations, scanning modes, scope definitions, contexts, and technology detection mechanisms.

### Key Topics - **Session Persistence**: When launching ZAP, users are prompted whether to persist the session. ZAP relies on an underlying HSQLDB database; persisting at startup writes continuously to this database without needing an expensive copy operation upon exit. - **Interface Layout and Customization**: ZAP features three primary windows: the Sites tree on the left (hierarchical data), a central work area (requests, responses, and settings), and lower information tabs (alerts, spider progress, active scan, history). Layouts can be adjusted, tabs can be revealed via a green tab selector or pinned, and tab names can be hidden for compact displays. - **Quick Start and Automated Scanning**: The Quick Start tab provides resources (PDF Getting Started guide, desktop user guide, user group) and a streamlined automated scan. Entering a target URL sequentially launches exploration (traditional spider, and optionally AJAX spider) followed by the active scanner. - **Modes and Contexts**: ZAP offers operational modes including Safe mode (blocks any attacking actions), Protected mode (only allows attacking assets explicitly marked in scope), and Standard mode (allows attacking any target). Contexts group URLs using regexes and serve as the baseline for configuring authentication, custom application structures, and specific technology stacks. - **Add-on Marketplace & Table Views**: Users can extend ZAP via the add-on marketplace, download released/beta scan rules, and customize information tables using the corner menu on column headers.

### Technical Details - **Sites Tree Internals**: The Sites tree represents ZAP's internal functional model of the target. ZAP distinguishes between HTTP methods (e.g., GET vs. POST on `/basket`) and path variations, but groups requests with differing parameter values under a single node by default (e.g., searches with different queries are treated as identical functionality). - **Scan Rules & Technology Filtering**: In active scan policies, rules are assigned based on target technology (such as specific SQL injection rules targeting Oracle, MySQL, MS SQL, or SQLite). When technology filters are applied in a context during white-box testing, scan rules still trigger from the policy but internally check the flag and abort execution if the technology is disabled. Bennetts also demonstrates the Wappalyzer add-on, which operates via the passive scanner to dynamically detect technologies from traffic.

### Takeaways Familiarity with ZAP's desktop UI accelerates effective automation and API scripting. Correctly configuring contexts, scopes, and technology flags prevents unintended scans and speeds up testing routines. Testing should only be conducted against targets where explicit permission has been granted.