HelpStartConceptsScanpolicy

Scan Policy

A scan policy defines exactly which rules are run as part of an active scan. It also defines how these rules run influencing how many requests are made and how likely potential issues are to be flagged. You can define as many scan policies as you like and select the most appropriate one when you start the scan via the Active Scan Dialog. You can define the default scan policy to be used for active scans and for the Attack mode via the Options Active Scan screen.

Active scanning is an attack on those targets. You should NOT use it on web applications that you do not own.

It should be noted that active scanning can only find certain types of vulnerabilities. Logical vulnerabilities, such as broken access control, will not be found by any active or automated vulnerability scanning. Manual penetration testing should always be performed in addition to active scanning to find all types of vulnerabilities.

Active scanning is configured using the Options Active Scan screen. You can also define as many scan policies as you like - these define exactly which rules are run and how they work.

Accessed via

	Active Scan tab
	Sites tab	'Attack/Active Scan site' right click menu item
	Sites tab	'Attack/Active Scan node' right click menu item
	History tab	'Scan this History' right click menu item

See also

	UI Overview	for an overview of the user interface
	Features	provided by ZAP
	Passive scanning
	Scan Policy Manager Dialog	which allows you to manage the scan policies
	Scanner Rules	supported by default