OWASP Zap警报名称

Question

I am looking for documentation describing all possible alert names in ZAP. Web search is not bringing anything useful, but I am writing an automated test that will detect any injection vulnerabilities of a target. Currently, I have only detected 'Remote OS Command Injection', but I would like to know the exact spelling of other potential ones eg, SSI injection, or XML External Entity. Many thanks.

Answer 1

Here you can find the list of all the rules that Zap loads, and those rules are what generates the alerts. You should have the rule id in the alert generated by Zap, so you can use that. Also, you customize some rules thresholds for your need - all documented on Zap's wiki.