2.15.0
D-2021-10-18
https://github.com/zaproxy/zaproxy/releases/download/w2021-10-18/ZAP_WEEKLY_D-2021-10-18.zip
ZAP_WEEKLY_D-2021-10-18.zip
SHA-256:9d4bcb12e47293f3cbc4c32285b8469e620f092bb2519e65e12e5e528a25a8ad
188556676
https://github.com/zaproxy/zaproxy/releases/download/v2.15.0/ZAP_2_15_0_windows-x32.exe
ZAP_2_15_0_windows-x32.exe
SHA-256:114953f29647a5e4e5774b338f2271d6149711e9222e0b92b11be3a35b812478
238554112
https://github.com/zaproxy/zaproxy/releases/download/v2.15.0/ZAP_2_15_0_windows.exe
ZAP_2_15_0_windows.exe
SHA-256:28b348dd65116ddabbbbd98b7f84864a0bb0f98d656266f2f08bfd010ae51c57
238683648
https://github.com/zaproxy/zaproxy/releases/download/v2.15.0/ZAP_2.15.0_Linux.tar.gz
ZAP_2.15.0_Linux.tar.gz
SHA-256:6410e196baab458a9204e29aafb5745fca003a2a6c0386f2c6e5c04b67621fa7
231558370
https://github.com/zaproxy/zaproxy/releases/download/v2.15.0/ZAP_2.15.0.dmg
ZAP_2.15.0.dmg
SHA-256:ae025403e46cdefff013cd0c3b88d8edc5a183a76daa63cb62c7c629005337a5
261781621
Bug fix and enhancement release.
https://www.zaproxy.org/docs/desktop/releases/2.15.0/
accessControl
Access Control Testing
Adds a set of tools for testing access control in web applications.
ZAP Dev Team
10
accessControl-alpha-10.zap
alpha
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.14.0.</li>
<li>Maintenance changes.</li>
<li>Link website alert pages and help (Issues 8189).</li>
<li>The results table now presents the same context menu as other similar tables (History, Search, etc) facilitating copying URLs, etc (Issue 8356).</li>
<li>Now has a table export button (Issue 8356).</li>
<li>Adjusted some labels/titles to use title caps (Issue 2000 & 8356).</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Now uses the General Font (Issue 8356), as set in the Display options.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/accessControl-v10/accessControl-alpha-10.zap
SHA-256:8e068a789650cd31a5a4592cf57af3dbcb04b98f6fcd20bf752889c3843cbce8
https://www.zaproxy.org/docs/desktop/addons/access-control-testing/
https://github.com/zaproxy/zap-extensions/
2024-03-25
597028
2.14.0
commonlib
>= 1.17.0 & < 2.0.0
alertFilters
Alert Filters
Allows you to automate the changing of alert risk levels.
ZAP Dev Team
22
alertFilters-release-22.zap
release
<h3>Fixed</h3>
<ul>
<li>Handle deleted alerts gracefully.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/alertFilters-v22/alertFilters-release-22.zap
SHA-256:a8036a258f67b9974cb07407e274bb2535e56a78b5b85c51b1ee5e6544e034c9
https://www.zaproxy.org/docs/desktop/addons/alert-filters/
https://github.com/zaproxy/zap-extensions/
2024-10-07
566059
2.15.0
allinonenotes
All In One Notes
A simple extension to view all notes in one pane.
David Vassallo
2
allinonenotes-alpha-2.zap
alpha
<h3>Added</h3>
<ul>
<li>Add info and repo URLs.</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.11.0.</li>
<li>Update link to repository.</li>
<li>Maintenance changes.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/allinonenotes-v2/allinonenotes-alpha-2.zap
SHA-256:9e70d6e76b72692e9c0cb64002a692b710710e688ea2d8834818086300632d2a
https://www.zaproxy.org/docs/desktop/addons/all-in-one-notes/
https://github.com/zaproxy/zap-extensions/
2021-10-07
249532
2.11.0
ascanrules
Active scanner rules
The release status Active Scanner rules
ZAP Dev Team
69
ascanrules-release-69.zap
release
<h3>Changed</h3>
<ul>
<li>The XML External Entity Attack scan rule now include example alert functionality for documentation generation purposes (Issue 6119).</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Added more checks for valid .htaccess files to reduce false positives (Issue 7632).</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/ascanrules-v69/ascanrules-release-69.zap
SHA-256:0d5aae9ca89f7329590591199f382d9c12248b3cb02fa7d73167fb87c5e2646a
https://www.zaproxy.org/docs/desktop/addons/active-scan-rules/
https://github.com/zaproxy/zap-extensions/
2024-10-23
3302878
2.15.0
commonlib
>= 1.21.0 & < 2.0.0
network
>= 0.3.0
oast
>= 0.7.0
ascanrulesAlpha
Active scanner rules (alpha)
The alpha status Active Scanner rules
ZAP Dev Team
48
ascanrulesAlpha-alpha-48.zap
alpha
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.15.0.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Alert text for various rules has been updated to more consistently use periods and spaces in a uniform manner.</li>
<li>Potential false positives in the LDAP Injection scan rule when the original message resulted in an error to start with (Issue 8519).</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/ascanrulesAlpha-v48/ascanrulesAlpha-alpha-48.zap
SHA-256:59260c6445736290ed2c3c553a4a5e085a33226411009c6ad21ee157753f89fc
https://www.zaproxy.org/docs/desktop/addons/active-scan-rules-alpha/
https://github.com/zaproxy/zap-extensions/
2024-09-02
402920
2.15.0
commonlib
>= 1.22.0 & < 2.0.0
ascanrulesBeta
Active scanner rules (beta)
The beta status Active Scanner rules
ZAP Dev Team
56
ascanrulesBeta-beta-56.zap
beta
<h3>Changed</h3>
<ul>
<li>Log exception details in Out of Band XSS scan rule.</li>
<li>Maintenance changes.</li>
<li>The Anti-CSRF Tokens Check scan rule now only considers GET requests at Low Threshold (Issue 7741).</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Address time-based false positives in Remote Code Execution - Shell Shock scan rule (Issue 8516).</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/ascanrulesBeta-v56/ascanrulesBeta-beta-56.zap
SHA-256:e6dd4dc66fe79f192fae8e336e1708ca710eac190a04c79f1cd01e3fa9f2432c
https://www.zaproxy.org/docs/desktop/addons/active-scan-rules-beta/
https://github.com/zaproxy/zap-extensions/
2024-09-24
1768903
2.15.0
commonlib
>= 1.17.0 & < 2.0.0
database
>= 0.1.0
network
>= 0.3.0
oast
>= 0.7.0
attacksurfacedetector
Attack Surface Detector
The Attack Surface Detector analyzes web application source code to generate endpoints that can be used for penetration testing.
Secure Decisions (Matthew DeLetto)
1.1.4
attacksurfacedetector-alpha-1.1.4.zap
alpha
Various incremental changes (see https://github.com/secdec/attack-surface-detector-zap/releases)<br>
Fix un-handled exception when target unavailable & address various "house keeping" tasks.<br>
https://github.com/zaproxy/zap-extensions/releases/download/2.7/attacksurfacedetector-alpha-1.1.4.zap
SHA1:e21758c2cdcbc7806f44cc986a88360457eff82e
https://github.com/secdec/attack-surface-detector-zap/wiki
https://github.com/secdec/attack-surface-detector-zap/
2019-03-07
15604948
2.7.0
authhelper
Authentication Helper
Helps identify and set up authentication handling
ZAP Dev Team
0.16.0
authhelper-beta-0.16.0.zap
beta
<h3>Fixed</h3>
<ul>
<li>Address concurrency issue while passive scanning with the Session Management Response Identified scan rule (Issue 8187).</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/authhelper-v0.16.0/authhelper-beta-0.16.0.zap
SHA-256:ef6a2362387c67598cd6861dbf9350b646c14d79b923e6013404ccddc2db547f
https://www.zaproxy.org/docs/desktop/addons/authentication-helper/
https://github.com/zaproxy/zap-extensions/
2024-11-06
813708
2.15.0
commonlib
>= 1.13.0 & < 2.0.0
network
>=0.6.0
selenium
15.*
authstats
Authentication Statistics
Records logged in/out statistics for all contexts in scope.
ZAP Dev Team
2
authstats-alpha-2.zap
alpha
<h3>Added</h3>
<ul>
<li>Add repo URL.</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.11.0.</li>
<li>Dynamically unload the add-on.</li>
<li>Change info URL to link to the site.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/authstats-v2/authstats-alpha-2.zap
SHA-256:cfb604c27f3a7a58e7b5aa55fe9f19a9ce5561fab3ef7d3f6c72845671fb5dcf
https://www.zaproxy.org/docs/desktop/addons/authentication-statistics/
https://github.com/zaproxy/zap-extensions/
2021-10-07
247499
2.11.0
automation
Automation Framework
Automation Framework.
ZAP Dev Team
0.43.0
automation-beta-0.43.0.zap
beta
<h3>Fixed</h3>
<ul>
<li>Handle exceptions while running jobs.</li>
</ul>
<h3>Changed</h3>
<ul>
<li>In saved YAML plans:
<ul>
<li>Fields with default values are omitted.</li>
<li>The "name" and "type" fields are added before other fields.</li>
<li>Values are not quoted unless required.</li>
</ul>
</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/automation-v0.43.0/automation-beta-0.43.0.zap
SHA-256:d765faa76ccc53a36d3622fea5ac3a12cf42f2c0d6372c692be2afc3abe69626
https://www.zaproxy.org/docs/desktop/addons/automation-framework/
https://github.com/zaproxy/zap-extensions/
2024-10-07
1770789
2.15.0
commonlib
>= 1.17.0 & < 2.0.0
network
>= 0.15.0 & < 1.0.0
beanshell
BeanShell Console
Provides a BeanShell Console
ZAP Dev Team
7
beanshell-beta-7.zap
beta
<h3>Added</h3>
<ul>
<li>Add info and repo URLs.</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.11.0.</li>
<li>Maintenance changes.</li>
<li>Improve permissions and space handling when saving.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/beanshell-v7/beanshell-beta-7.zap
SHA-256:0a83cb7d0369ccef50768ccbda1e6c6d82b9f4e3bd9372b38fd32cc21f6a30fb
https://www.zaproxy.org/docs/desktop/addons/bean-shell/
https://github.com/zaproxy/zap-extensions/
2021-10-07
577838
2.11.0
browserView
Browser View
Adds an option to render HTML responses like a browser
ZAP Dev Team
6
browserView-alpha-6.zap
alpha
<h3>Added</h3>
<ul>
<li>Add info and repo URLs.</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.12.0.</li>
<li>Maintenance changes.</li>
<li>Make missing JavaFX logging less verbose in regular use.</li>
<li>Update help with the requirements to use the add-on.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/browserView-v6/browserView-alpha-6.zap
SHA-256:e53cfde3a009a4be2e40c84ac02e05114505160bd2bab6cbb42416ab9a65b16c
https://www.zaproxy.org/docs/desktop/addons/browser-view/
https://github.com/zaproxy/zap-extensions/
2023-03-13
197667
2.12.0
bruteforce
Forced Browse
Forced browsing of files and directories using code from the OWASP DirBuster tool
ZAP Dev Team
16
bruteforce-beta-16.zap
beta
<h3>Added</h3>
<ul>
<li>Support for menu weights (Issue 8369).</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.15.0.</li>
<li>Maintenance changes.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Help content typos.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/bruteforce-v16/bruteforce-beta-16.zap
SHA-256:01c8d25f1ef05dfc85d0feadbff38f7891f859d088a81041e6fca59be5e74cd0
https://www.zaproxy.org/docs/desktop/addons/forced-browse/
https://github.com/zaproxy/zap-extensions/
2024-05-07
553638
2.15.0
commonlib
>= 1.23.0 & < 2.0.0
bugtracker
Bug Tracker
Bug Tracker extension.
ZAP Dev Team
4
bugtracker-alpha-4.zap
alpha
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.11.1.</li>
<li>Dependency updates.</li>
<li>Maintenance changes.</li>
<li>Updated to use PAT not password (https://github.blog/changelog/2021-08-12-git-password-authentication-is-shutting-down/).</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/bugtracker-v4/bugtracker-alpha-4.zap
SHA-256:37c57f8e7f4a1608500527ac1831f8b078427f804ea04ad5790a2970e3e1b722
https://www.zaproxy.org/docs/desktop/addons/bug-tracker/
https://github.com/zaproxy/zap-extensions/
2022-09-23
3707425
2.11.1
callgraph
Call Graph
Allows the user to view a call graph of the selected resources
Colm O'Flaherty
5
callgraph-alpha-5.zap
alpha
<h3>Added</h3>
<ul>
<li>Add help.</li>
<li>Add info and repo URLs.</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.11.0.</li>
<li>Maintenance changes.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/callgraph-v5/callgraph-alpha-5.zap
SHA-256:0874ce5aad0c4bbf28f72627a4940759d328396e12b7d6a5596f2e41bf24dc4e
https://www.zaproxy.org/docs/desktop/addons/call-graph/
https://github.com/zaproxy/zap-extensions/
2021-10-07
925930
2.11.0
callhome
Call Home
Handles all of the calls to ZAP services.
ZAP Dev Team
0.13.0
callhome-release-0.13.0.zap
release
<h3>Added</h3>
<ul>
<li>Tech stats to telemetry.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/callhome-v0.13.0/callhome-release-0.13.0.zap
SHA-256:b0b9ed9e68fee11fceac339a49c96e7f21e1a377270dde08ada65aecd795454f
https://www.zaproxy.org/docs/desktop/addons/call-home/
https://github.com/zaproxy/zap-extensions/
2024-09-02
322396
2.15.0
client
Client Side Integration
Exposes client (browser) side information in ZAP using Firefox and Chrome extensions.
ZAP Dev Team
0.9.0
client-alpha-0.9.0.zap
alpha
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.15.0.</li>
<li>Updated Chrome and Firefox extensions to v0.0.9.</li>
</ul>
<h3>Added</h3>
<ul>
<li>Support for menu weights (Issue 8369).</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Address exception with deleted messages while handling client event.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/client-v0.9.0/client-alpha-0.9.0.zap
SHA-256:262028f8388d8e948097e716c315c0d3943d4835753505dc88be5efe92655cf2
https://www.zaproxy.org/docs/desktop/addons/client-side-integration/
https://github.com/zaproxy/zap-extensions/
2024-11-29
1652849
2.15.0
commonlib
>=1.23.0
network
>=0.8.0
selenium
>=15.14.0
commonlib
Common Library
A common library, for use by other add-ons.
ZAP Dev Team
1.28.0
commonlib-release-1.28.0.zap
release
<h3>Changed</h3>
<ul>
<li>Maintenance changes.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/commonlib-v1.28.0/commonlib-release-1.28.0.zap
SHA-256:243aea9f7273c0b69621b7a6fb5a912fc8e91e2b24f34236929f87b24804cbdc
https://www.zaproxy.org/docs/desktop/addons/common-library/
https://github.com/zaproxy/zap-extensions/
2024-09-24
15141417
2.15.0
communityScripts
Community Scripts
Useful ZAP scripts written by the ZAP community.
ZAP Community
19
communityScripts-alpha-19.zap
alpha
<h3>Added</h3>
<ul>
<li>extender/arpSyndicateSubdomainDiscovery.js - uses the API of <a href="https://www.subdomain.center/">ARPSyndicate's Subdomain Center</a>
to find and add subdomains to the Sites Tree.</li>
<li>passive/JavaDisclosure.js - Passive scan for Java error messages leaks</li>
<li>httpsender/RsaEncryptPayloadForZap.py - A script that encrypts requests using RSA</li>
<li>selenium/FillOTPInMFA.js - A script that fills the OTP in MFA</li>
<li>authentication/KratosApiAuthentication.js - A script to authenticate with Kratos using the API flow</li>
<li>authentication/KratosBrowserAuthentication.js - A script to authenticate with Kratos using the browser flow</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.15.0.</li>
<li>Use Prettier to format all JavaScript scripts.</li>
<li>Update the following scripts to implement the <code>getMetadata()</code> function with revised metadata:
<ul>
<li>active/Cross Site WebSocket Hijacking.js</li>
<li>active/cve-2019-5418.js</li>
<li>active/gof_lite.js</li>
<li>active/JWT None Exploit.js</li>
<li>active/SSTI.js</li>
<li>passive/clacks.js</li>
<li>passive/CookieHTTPOnly.js</li>
<li>passive/detect_csp_notif_and_reportonly.js</li>
<li>passive/detect_samesite_protection.js</li>
<li>passive/f5_bigip_cookie_internal_ip.js</li>
<li>passive/find base64 strings.js</li>
<li>passive/Find Credit Cards.js</li>
<li>passive/Find Emails.js</li>
<li>passive/Find Hashes.js</li>
<li>passive/Find HTML Comments.js</li>
<li>passive/Find IBANs.js</li>
<li>passive/Find Internal IPs.js</li>
<li>passive/find_reflected_params.py</li>
<li>passive/HUNT.py</li>
<li>passive/Mutliple Security Header Check.js</li>
<li>passive/google_api_keys_finder.js</li>
<li>passive/JavaDisclosure.js</li>
<li>passive/Report non static sites.js</li>
<li>passive/RPO.js</li>
<li>passive/s3.js</li>
<li>passive/Server Header Disclosure.js</li>
<li>passive/SQL injection detection.js</li>
<li>passive/Telerik Using Poor Crypto.js</li>
<li>passive/Upload form discovery.js</li>
<li>passive/X-Powered-By_header_checker.js</li>
</ul>
</li>
<li>httpsender/Alert on Unexpected Content Types.js now checks for common content-types (<code>json</code>, <code>xml</code>, and <code>yaml</code>) more consistently.</li>
<li>targeted/request_to_xml.js no longer uses deprecated method to show the message in the editor dialogue.</li>
</ul>
https://github.com/zaproxy/community-scripts/releases/download/v19/communityScripts-alpha-19.zap
SHA-256:f96502b471dd349ae2fceba4a68bde9465091580040ad8798e13bb176030bbba
https://www.zaproxy.org/docs/desktop/addons/community-scripts/
https://github.com/zaproxy/community-scripts/
2024-07-01
475346
2.15.0
coreLang
Core Language Files
Translations of the core language files
ZAP Dev Team
15
coreLang-release-15.zap
release
<h3>Changed</h3>
<ul>
<li>Update the languages files from Crowdin.</li>
<li>Update minimum ZAP version to 2.11.1.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/coreLang-v15/coreLang-release-15.zap
SHA-256:d8258b914ffc95820dd045acf56677668a8cbbfc759290f72e30210056dfb88c
https://crowdin.com/project/zaproxy
https://github.com/zaproxy/zap-extensions/
2022-02-14
4616009
2.11.1
custompayloads
Custom Payloads
Ability to add, edit or remove payloads that are used i.e. by active scanners
ZAP Dev Team
0.13.0
custompayloads-beta-0.13.0.zap
beta
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.14.0.</li>
<li>Maintenance changes.</li>
<li>Promoted to Beta.</li>
</ul>
<h3>Added</h3>
<ul>
<li>Initial API support:
<ul>
<li>Actions
<ul>
<li>Enable payloads.</li>
<li>Disable payloads.</li>
<li>Enable payload.</li>
<li>Disable payload.</li>
<li>Add payload.</li>
<li>Remove payload.</li>
</ul>
</li>
<li>Views:
<ul>
<li>Payload categories.</li>
<li>Payloads (optionally filtered by category).</li>
</ul>
</li>
</ul>
</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/custompayloads-v0.13.0/custompayloads-beta-0.13.0.zap
SHA-256:07c571e121291980add70fad1b64933382742e93959c7dd470426b4fb111921e
https://www.zaproxy.org/docs/desktop/addons/custom-payloads/
https://github.com/zaproxy/zap-extensions/
2023-11-10
246425
2.14.0
database
Database
Provides database engines and related infrastructure.
ZAP Dev Team
0.6.0
database-alpha-0.6.0.zap
alpha
<h3>Added</h3>
<ul>
<li>Allow to access persistence manager of the database.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/database-v0.6.0/database-alpha-0.6.0.zap
SHA-256:63b9318b4fd82652bd45e84b59d38747e8825af17534061fada5bab504131e4f
https://www.zaproxy.org/docs/desktop/addons/database/
https://github.com/zaproxy/zap-extensions/
2024-09-17
23094122
2.15.0
dev
Dev Add-on
An add-on to help with development of ZAP.
ZAP Dev Team
0.8.0
dev-alpha-0.8.0.zap
alpha
<h3>Changed</h3>
<ul>
<li>Sequence performance test to make it actually possible to test it using automation.</li>
<li>CSS and JS responses are now set cache enabled.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/dev-v0.8.0/dev-alpha-0.8.0.zap
SHA-256:45b8d23e224a2cfcaae3d1c210ff8044e5176efdb12a71509593637d14ce1762
https://www.zaproxy.org/docs/desktop/addons/dev-add-on/
https://github.com/zaproxy/zap-extensions/
2024-11-13
153852
2.15.0
commonlib
>=1.17.0
network
>=0.7.0
diff
Diff
Displays a dialog showing the differences between 2 requests or responses. It uses diffutils and diff_match_patch
ZAP Dev Team
16
diff-beta-16.zap
beta
<h3>Updated</h3>
<ul>
<li>Add-on help content.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/diff-v16/diff-beta-16.zap
SHA-256:36baf1f731573c3ef0d7657403b7d789a4be2fe5ae59f9b18c112726d0c8cc0e
https://www.zaproxy.org/docs/desktop/addons/diff/
https://github.com/zaproxy/zap-extensions/
2024-10-07
679075
2.15.0
commonlib
>=1.23.0
directorylistv1
Directory List v1.0
List of directory names to be used with Forced Browse or Fuzzer add-on.
ZAP Dev Team
8
directorylistv1-release-8.zap
release
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.15.0.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/directorylistv1-v8/directorylistv1-release-8.zap
SHA-256:8f5eb460d8c57a7a26566b7b653c8557a875d40245ad6bb4ad0cdef60b56ea18
https://www.zaproxy.org/docs/desktop/addons/directory-list-v1.0/
https://github.com/zaproxy/zap-extensions/
2024-05-07
961163
2.15.0
directorylistv2_3
Directory List v2.3
Lists of directory names to be used with Forced Browse or Fuzzer add-on.
ZAP Dev Team
4
directorylistv2_3-release-4.zap
release
<h3>Added</h3>
<ul>
<li>Add help.</li>
<li>Add repo URL.</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.11.0.</li>
<li>Change info URL to link to the site.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/directorylistv2_3-v4/directorylistv2_3-release-4.zap
SHA-256:3a8b04b9363b57acd9cf8cd67abce4c630f986e2b492a1ebd01eaa9587a0a199
https://www.zaproxy.org/docs/desktop/addons/directory-list-v2.3/
https://github.com/zaproxy/zap-extensions/
2021-10-07
8722229
2.11.0
directorylistv2_3_lc
Directory List v2.3 LC
Lists of lower case directory names to be used with Forced Browse or Fuzzer add-on.
ZAP Dev Team
4
directorylistv2_3_lc-release-4.zap
release
<h3>Added</h3>
<ul>
<li>Add help.</li>
<li>Add repo URL.</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.11.0.</li>
<li>Change info URL to link to the site.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/directorylistv2_3_lc-v4/directorylistv2_3_lc-release-4.zap
SHA-256:2603580ba53673c31800ef7373e7cc09de759369b6f8fb43cc9e5024ad5d9af4
https://www.zaproxy.org/docs/desktop/addons/directory-list-v2.3-lc/
https://github.com/zaproxy/zap-extensions/
2021-10-07
7569974
2.11.0
domxss
DOM XSS Active scanner rule
DOM XSS Active scanner rule
Aabha Biyani, ZAP Dev Team
19
domxss-release-19.zap
release
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.15.0.</li>
<li>Maintenance changes.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/domxss-v19/domxss-release-19.zap
SHA-256:6bc85e3ced67a1e2039bdda92b9d3cc0e8e4a8abea8b49fc3685c793736b101d
https://www.zaproxy.org/docs/desktop/addons/dom-xss-active-scan-rule/
https://github.com/zaproxy/zap-extensions/
2024-05-07
271507
2.15.0
commonlib
>= 1.17.0 & < 2.0.0
network
>=0.1.0
selenium
>= 15.13.0
encoder
Encoder
Adds encode/decode/hash dialog and support for scripted processors as well
ZAP Dev Team
1.5.0
encoder-release-1.5.0.zap
release
<h3>Added</h3>
<ul>
<li>Support for menu weights (Issue 8369)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.15.0.</li>
<li>Maintenance changes.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/encoder-v1.5.0/encoder-release-1.5.0.zap
SHA-256:5914245314d1c9eba1892097318c089aef9d89e107bf61745093924e4591d632
https://www.zaproxy.org/docs/desktop/addons/encode-decode-hash/
https://github.com/zaproxy/zap-extensions/
2024-05-07
470124
2.15.0
commonlib
>=1.23.0
evalvillain
Eval Villain
Adds the Eval Villain extension to Firefox when launched from ZAP.
Dennis Goodlett and the ZAP Dev Team
0.4.0
evalvillain-alpha-0.4.0.zap
alpha
<h3>Changed</h3>
<ul>
<li>Updated with new version of Eval Villain.</li>
<li>Update minimum ZAP version to 2.15.0.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/evalvillain-v0.4.0/evalvillain-alpha-0.4.0.zap
SHA-256:dedb6245cee2383b13eb4c0c58301ee2518c6e0af36359559f2e1638a8a076e3
https://www.zaproxy.org/docs/desktop/addons/eval-villain/
https://github.com/zaproxy/zap-extensions/
2024-11-25
4957040
2.15.0
selenium
>=15.5.0
exim
Import/Export
Import and Export functionality
ZAP Dev Team & thatsn0tmysite
0.12.0
exim-beta-0.12.0.zap
beta
<h3>Changed</h3>
<ul>
<li>Improved HTTP 1.1 traffic detection in PCAP files</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Count invalid messages as tasks done toward progress when importing HARs.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/exim-v0.12.0/exim-beta-0.12.0.zap
SHA-256:290a834250748f885ba57f7c54ca662bdc065057341dea2486baba4f9b7379cf
https://www.zaproxy.org/docs/desktop/addons/import-export/
https://github.com/zaproxy/zap-extensions/
2024-10-07
3019308
2.15.0
commonlib
>= 1.28.0 & < 2.0.0
fileupload
FileUpload
Detect File upload requests and scan them to find related vulnerabilities
KSASAN preetkaran20@gmail.com
1.2.1
fileupload-alpha-1.2.1.zap
alpha
https://github.com/zaproxy/zap-extensions/releases/download/2.7/fileupload-alpha-1.2.1.zap
SHA-256:84734320ed04f6e287cc0458897e99e80fe16d632d071e73187e446448b5fa7f
https://www.zaproxy.org/blog/2021-08-20-zap-fileupload-addon/
https://github.com/SasanLabs/owasp-zap-fileupload-addon/
2023-10-23
78272
2.11.0
formhandler
Value Generator
This Value Generator Add-on allows a user to define field names and values to be used when submitting values to an app. Fields can be added, modified, enabled/disabled, and deleted.
ZAP Dev Team
6.6.0
formhandler-beta-6.6.0.zap
beta
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.15.0.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/formhandler-v6.6.0/formhandler-beta-6.6.0.zap
SHA-256:a9dd593ce8fc116ce0ea9545db734d0ab166a452edac3857985ce3e8b14a108b
https://www.zaproxy.org/docs/desktop/addons/value-generator/
https://github.com/zaproxy/zap-extensions/
2024-05-07
2126686
2.15.0
fuzz
Fuzzer
Advanced fuzzer for manual testing
ZAP Dev Team
13.14.0
fuzz-beta-13.14.0.zap
beta
<h3>Changed</h3>
<ul>
<li>Maintenance changes.</li>
<li>Replace library used for regex payload generation, to address performance and compatibility issues.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/fuzz-v13.14.0/fuzz-beta-13.14.0.zap
SHA-256:259c116cf914cd20477447251da5da7c11b847b52dd80389c6fa208866851f48
https://www.zaproxy.org/docs/desktop/addons/fuzzer/
https://github.com/zaproxy/zap-extensions/
2024-10-07
2011237
2.15.0
commonlib
>= 1.23.0 & < 2.0.0
fuzzai
FuzzAI Files
FuzzAI files which can be used with the ZAP fuzzer
ZAP Dev Team
0.0.1
fuzzai-release-0.0.1.zap
release
<h3>Added</h3>
<ul>
<li>First version</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/fuzzai-v0.0.1/fuzzai-release-0.0.1.zap
SHA-256:7d60565b5814b8523514c5d8001d0bdf1f30f6d96cae9b4ac0abb45ee7abcaea
https://www.zaproxy.org/docs/desktop/addons/fuzzai-files/
https://github.com/zaproxy/zap-extensions/
2024-09-24
50063
2.15.0
fuzzdb
FuzzDB Files
FuzzDB files which can be used with the ZAP fuzzer
ZAP Dev Team
9
fuzzdb-release-9.zap
release
<h3>Changed</h3>
<ul>
<li>Updated RAFT lists based on more recent SecLists contributions</li>
<li>Update minimum ZAP version to 2.11.1.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/fuzzdb-v9/fuzzdb-release-9.zap
SHA-256:c79537362cd6b383f447359685e3bd51795600b97ca0c1fadc4ba74828a7d4f4
https://www.zaproxy.org/docs/desktop/addons/fuzzdb-files/
https://github.com/zaproxy/zap-extensions/
2022-09-23
6167205
2.11.1
fuzzdboffensive
FuzzDB Offensive
FuzzDB web backdoors and attack files which can be used with the ZAP fuzzer or for manual penetration testing - contains files that may well be flagged by anti-virus tools
ZAP Dev Team
5
fuzzdboffensive-release-5.zap
release
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.14.0.</li>
<li>Updated help and description to say this may cause problems with anti-virus tools (Issue 8297).</li>
</ul>
https://github.com/zaproxy/fuzzdb-offensive/releases/download/v5/fuzzdboffensive-release-5.zap
SHA-256:9d7bf6f8df62e5ee56e72b47785e6027674127ae70604d9c4f6dc0cea1f536dc
https://www.zaproxy.org/docs/desktop/addons/fuzzdb-offensive/
https://github.com/zaproxy/fuzzdb-offensive/
2024-01-11
523693
2.14.0
gettingStarted
Getting Started with ZAP Guide
A short Getting Started with ZAP Guide
ZAP Dev Team
18
gettingStarted-release-18.zap
release
<h3>Changed</h3>
<ul>
<li>Rebrand to ZAP by Checkmarx.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/gettingStarted-v18/gettingStarted-release-18.zap
SHA-256:8253e27e7fd43ecc2baad50c0488c5678cf9885b5db3ce12c327c8fc5e34277c
https://www.zaproxy.org/docs/desktop/addons/getting-started-guide/
https://github.com/zaproxy/zap-extensions/
2024-09-24
968579
2.15.0
graaljs
GraalVM JavaScript
Provides the GraalVM JavaScript engine for ZAP scripting.
ZAP Dev Team
0.8.0
graaljs-alpha-0.8.0.zap
alpha
<h3>Added</h3>
<ul>
<li>Document the engine name in the help page.</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Maintenance changes.</li>
<li>Update script templates:
<ul>
<li>authentication/Authentication default template GraalJS.js - remove outdated example code.</li>
<li>httpsender/AddZapHeader GraalJS.js - fix runtime error (Issue 8611) and update documentation.</li>
<li>httpsender/HttpSender default template GraalJS.js - update documentation.</li>
</ul>
</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/graaljs-v0.8.0/graaljs-alpha-0.8.0.zap
SHA-256:9821e4e66d0a5d6c84a4208e06b2b4eaf6c7962802618b8ec22a4c0e65b1d198
https://www.zaproxy.org/docs/desktop/addons/graalvm-javascript/
https://github.com/zaproxy/zap-extensions/
2024-09-24
24531423
2.15.0
commonlib
>=1.24.0
scripts
>=45.2.0
graphql
GraphQL Support
Inspect and attack GraphQL endpoints.
ZAP Dev Team
0.25.0
graphql-alpha-0.25.0.zap
alpha
<h3>Changed</h3>
<ul>
<li>Dependency updates.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/graphql-v0.25.0/graphql-alpha-0.25.0.zap
SHA-256:f4e491d9f7a7ec6918bee1093f8e7c4eeed9fd58e429ce4a0baf1fb60505fbda
https://www.zaproxy.org/docs/desktop/addons/graphql-support/
https://github.com/zaproxy/zap-extensions/
2024-09-24
5465649
2.15.0
commonlib
>= 1.17.0 & < 2.0.0
groovy
Groovy Support
Adds Groovy support to ZAP
ZAP Dev Team
3.2.0
groovy-beta-3.2.0.zap
beta
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.14.0.</li>
<li>Maintenance changes.</li>
<li>Replace usage of singletons with injected variables (e.g. <code>model</code>, <code>control</code>) in scripts.</li>
<li>Dependency updates.</li>
<li>Update Active and Passive Script Templates to include a <code>getMetadata</code> function. This will allow them to be used as regular scan rules.</li>
<li>Depend on the <code>commonlib</code> and <code>scripts</code> add-ons for scan rule scripts.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Updated encode-decode script template to conform to the latest method signatures.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/groovy-v3.2.0/groovy-beta-3.2.0.zap
SHA-256:2603bcff3728308c6dab09135def96a1209ce8219b0d1f9d861c59b5a8fc522e
https://www.zaproxy.org/docs/desktop/addons/groovy-support/
https://github.com/zaproxy/zap-extensions/
2024-04-11
20168743
2.14.0
commonlib
>=1.24.0
scripts
>=45.2.0
grpc
gRPC Support
Inspect, attack gRPC endpoints, and decode protobuf messages.
ZAP Dev Team
0.2.0
grpc-alpha-0.2.0.zap
alpha
<h3>Added</h3>
<ul>
<li>gRPC WebSocket Support Added</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Do not try to decode non-gRPC responses when active scanning, which would lead to unnecessary warnings.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/grpc-v0.2.0/grpc-alpha-0.2.0.zap
SHA-256:028464ebc6c80f36fd32088c7aede870f68940dcbb2064a0ed6bfe2bb93f37e1
https://www.zaproxy.org/docs/desktop/addons/grpc-support/
https://github.com/zaproxy/zap-extensions/
2024-07-02
8202269
2.15.0
help
Help - English
English version of the ZAP help file.
ZAP Crowdin Team
18
help-release-18.zap
release
<h3>Added</h3>
<ul>
<li><code>-loglevel</code> option to the command line help page.</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Update OWASP ZAP homepage link in 1.1.0 release notes.</li>
<li>Updated for 2.15.0.</li>
</ul>
https://github.com/zaproxy/zap-core-help/releases/download/help-v18/help-release-18.zap
SHA-256:0e2dc4126f58cbcb07a7959dd14c2646b9070499760764854081cd86784737e3
https://www.zaproxy.org/docs/desktop/
https://github.com/zaproxy/zap-core-help/
2024-05-07
633801
2.14.0
help_ar_SA
Help - Arabic
Arabic version of the ZAP help file.
ZAP Crowdin Team
1
help_ar_SA-alpha-1.zap
alpha
<ul>
<li>First version.</li>
</ul>
https://github.com/zaproxy/zap-core-help/releases/download/help_ar_SA-v1/help_ar_SA-alpha-1.zap
SHA-256:8208b0c788d5e29a2bb34f3c44c07db613faefb17d8d9cfb60adc02629c2b3f1
https://github.com/zaproxy/zap-core-help/
2022-01-18
649333
2.11.0
help_bs_BA
Help - Bosnian
Bosnian version of the ZAP help file.
ZAP Crowdin Team
9
help_bs_BA-alpha-9.zap
alpha
Updated with the latest files from crowdin
https://github.com/zaproxy/zap-extensions/releases/download/2.7/help_bs_BA-alpha-9.zap
SHA1:d33a3277e877da4734e6bf9c911c61c4e6ce2f3f
2018-02-08
747536
2.7.0
help_es_ES
Help - Spanish
Spanish version of the ZAP help file.
ZAP Crowdin Team
10
help_es_ES-release-10.zap
release
<h3>Changed</h3>
<ul>
<li>Updated with the latest files from crowdin</li>
</ul>
https://github.com/zaproxy/zap-core-help/releases/download/help_es_ES-v10/help_es_ES-release-10.zap
SHA-256:63cc24e180374cf038d6aefe31b3f62e170437958ad61d2d3e65d2722fbedc1a
https://github.com/zaproxy/zap-core-help/
2022-01-18
697066
2.11.0
help_fil_PH
Help - Filipino
Filipino version of the ZAP help file.
ZAP Crowdin Team
3
help_fil_PH-alpha-3.zap
alpha
<h3>Changed</h3>
<ul>
<li>Updated with the latest files from crowdin</li>
</ul>
https://github.com/zaproxy/zap-core-help/releases/download/help_fil_PH-v3/help_fil_PH-alpha-3.zap
SHA-256:64bbeb0f9404b70c0d49e9fd5da789b8d3902a20f518c7305eb412242831a180
https://github.com/zaproxy/zap-core-help/
2022-01-18
710027
2.11.0
help_fr_FR
Help - French
French version of the ZAP help file.
ZAP Crowdin Team
10
help_fr_FR-alpha-10.zap
alpha
<h3>Changed</h3>
<ul>
<li>Updated with the latest files from crowdin</li>
</ul>
https://github.com/zaproxy/zap-core-help/releases/download/help_fr_FR-v10/help_fr_FR-alpha-10.zap
SHA-256:f1ede9441e5de48170fdef598eb543ef6ad0813eed2e838d2c4803ea114fcb1a
https://github.com/zaproxy/zap-core-help/
2022-01-18
646717
2.11.0
help_id_ID
Help - Indonesian
Indonesian version of the ZAP help file.
ZAP Crowdin Team
3
help_id_ID-beta-3.zap
beta
<h3>Changed</h3>
<ul>
<li>Updated with the latest files from crowdin</li>
</ul>
https://github.com/zaproxy/zap-core-help/releases/download/help_id_ID-v3/help_id_ID-beta-3.zap
SHA-256:ef50363872d783c3c49417bc821b28256cf35d8390004c48f6d4e030ceb8a7c5
https://github.com/zaproxy/zap-core-help/
2022-01-18
671009
2.11.0
help_ja_JP
Help - Japanese
Japanese version of the ZAP help file.
ZAP Crowdin Team
10
help_ja_JP-beta-10.zap
beta
<h3>Changed</h3>
<ul>
<li>Updated with the latest files from crowdin</li>
</ul>
https://github.com/zaproxy/zap-core-help/releases/download/help_ja_JP-v10/help_ja_JP-beta-10.zap
SHA-256:11d310352e8719fe50587c5b97dd5eeb3a2e2ab23e450a7c1d0fad013d003536
https://github.com/zaproxy/zap-core-help/
2022-01-18
661964
2.11.0
help_ms_MY
Help - Malay
Malay version of the ZAP help file.
ZAP Crowdin Team
1
help_ms_MY-alpha-1.zap
alpha
<ul>
<li>First version.</li>
</ul>
https://github.com/zaproxy/zap-core-help/releases/download/help_ms_MY-v1/help_ms_MY-alpha-1.zap
SHA-256:6407990b8ebaa2e401c3addc47081c742ab7fce25cec107ef49b4e627ad3ceae
https://github.com/zaproxy/zap-core-help/
2022-01-18
636908
2.11.0
help_pt_BR
Help - Portuguese, Brazilian
Portuguese, Brazilian version of the ZAP help file.
ZAP Crowdin Team
11
help_pt_BR-release-11.zap
release
<h3>Changed</h3>
<ul>
<li>Updated with the latest files from crowdin</li>
</ul>
https://github.com/zaproxy/zap-core-help/releases/download/help_pt_BR-v11/help_pt_BR-release-11.zap
SHA-256:3fdf92763c1c851848df6b3588c97bbeb22837002351fd00c8208d8ab01ff710
https://github.com/zaproxy/zap-core-help/
2022-01-18
682092
2.11.0
help_ru_RU
Help - Russian
Russian version of the ZAP help file.
ZAP Crowdin Team
2
help_ru_RU-release-2.zap
release
<h3>Changed</h3>
<ul>
<li>Promote to Release</li>
</ul>
https://github.com/zaproxy/zap-core-help/releases/download/help_ru_RU-v2/help_ru_RU-release-2.zap
SHA-256:3fd5d8e6af7453a3a16e7c38a19ec941a330d0fd050f562ecebdc4638ae52c80
https://github.com/zaproxy/zap-core-help/
2022-02-24
779171
2.11.0
help_tr_TR
Help - Turkish
Turkish version of the ZAP help file.
ZAP Crowdin Team
2
help_tr_TR-release-2.zap
release
<h3>Changed</h3>
<ul>
<li>Updated with the latest files from crowdin</li>
</ul>
https://github.com/zaproxy/zap-core-help/releases/download/help_tr_TR-v2/help_tr_TR-release-2.zap
SHA-256:a92b43beab5e196341d8ddf40d594f1596c225c74f0f5b9280e223acc9a8535c
https://github.com/zaproxy/zap-core-help/
2022-01-18
710766
2.11.0
help_zh_CN
Help - Chinese Simplified
Chinese Simplified version of the ZAP help file.
ZAP Crowdin Team
3
help_zh_CN-beta-3.zap
beta
<h3>Changed</h3>
<ul>
<li>Updated with the latest files from crowdin</li>
</ul>
https://github.com/zaproxy/zap-core-help/releases/download/help_zh_CN-v3/help_zh_CN-beta-3.zap
SHA-256:959b718a307ca32c7807c0d327533765eeb6a0a799b9bc98a2a1e22b3b47bc5a
https://github.com/zaproxy/zap-core-help/
2022-01-18
656718
2.11.0
highlighter
Highlighter
Allows you to highlight strings in the request and response tabs.
ZAP Dev Team
8
highlighter-alpha-8.zap
alpha
<h3>Added</h3>
<ul>
<li>Add help.</li>
<li>Add info and repo URLs.</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.11.0.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/highlighter-v8/highlighter-alpha-8.zap
SHA-256:4c4852bb2f42eb20dbe19a091e9025667947c73967a65770658333bedd01fccf
https://www.zaproxy.org/docs/desktop/addons/highlighter/
https://github.com/zaproxy/zap-extensions/
2021-10-07
115527
2.11.0
hud
HUD - Heads Up Display
Display information from ZAP in browser.
ZAP Dev Team
0.19.0
hud-beta-0.19.0.zap
beta
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.15.0.</li>
<li>Disable the HUD by default - it still works but its flaky, and currently not a focus for us.</li>
</ul>
https://github.com/zaproxy/zap-hud/releases/download/v0.19.0/hud-beta-0.19.0.zap
SHA-256:737239ce1b765ff32f9351a647594f22d725d319b94f7a2ef2cb153aadf832df
https://www.zaproxy.org/docs/desktop/addons/hud/
https://github.com/zaproxy/zap-hud/
2024-05-07
1382692
2.15.0
network
>= 0.1.0
websocket
imagelocationscanner
Image Location and Privacy Scanner
Image Location and Privacy Passive Scanner
Jay Ball (veggiespam) and the ZAP Dev Team
5
imagelocationscanner-beta-5.zap
beta
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.14.0.</li>
<li>Maintenance changes.</li>
</ul>
<h3>Added</h3>
<ul>
<li>Website alert links (Issue 8189).</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/imagelocationscanner-v5/imagelocationscanner-beta-5.zap
SHA-256:4d95a4e8c09fbae9372a28b2501c57ac3789b2357f4988fc0dcdc3c11f3f0fe8
https://www.zaproxy.org/docs/desktop/addons/image-location-and-privacy-scanner/
https://github.com/zaproxy/zap-extensions/
2024-04-11
1147406
2.14.0
commonlib
>= 1.6.0 & < 2.0.0
invoke
Invoke Applications
Invoke external applications passing context related information such as URLs and parameters
ZAP Dev Team
15
invoke-beta-15.zap
beta
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.15.0.</li>
</ul>
<h3>Added</h3>
<ul>
<li>Support for menu weights (Issue 8369)</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/invoke-v15/invoke-beta-15.zap
SHA-256:ff93f71447e26971a540d4f5029c5a1590b661dc4a32eb386810fe91b6ae794e
https://www.zaproxy.org/docs/desktop/addons/invoke-applications/
https://github.com/zaproxy/zap-extensions/
2024-05-07
322369
2.15.0
commonlib
>=1.23.0
jruby
Ruby Scripting
Allows Ruby to be used for ZAP scripting - templates included
ZAP Dev Team
8
jruby-beta-8.zap
beta
<h3>Changed</h3>
<ul>
<li>Update links to zaproxy repo.</li>
<li>Rename reliability to confidence in active/passive templates.</li>
<li>Maintenance changes.</li>
<li>Update minimum ZAP version to 2.11.0.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/jruby-v8/jruby-beta-8.zap
SHA-256:f5bb450a165f6c407b8d24f7b2776bdc7a2edb0b4b42aea385f8a6ad1ae605ca
https://www.zaproxy.org/docs/desktop/addons/ruby-scripting/
https://github.com/zaproxy/zap-extensions/
2021-10-07
21968128
2.11.0
jsonview
JSON View
Adds a view that shows JSON messages nicely formatted
Juha Kivekäs
3
jsonview-alpha-3.zap
alpha
<h3>Changed</h3>
<ul>
<li>Maintenance changes.</li>
<li>Update minimum ZAP version to 2.13.0.</li>
<li>Depend on Common Library add-on to reuse libraries (Issue 7961).</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Use other library to format the JSON bodies (Issue 7798).</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/jsonview-v3/jsonview-alpha-3.zap
SHA-256:ddafbbced033cc937ef37182e3650119dee3c7e5f1ac4ded73ea42125467184d
https://www.zaproxy.org/docs/desktop/addons/json-view/
https://github.com/zaproxy/zap-extensions/
2023-09-07
120558
2.13.0
commonlib
>= 1.16.0 & < 2.0.0
jwt
JWT Support
Detect JWT requests and scan them to find related vulnerabilities
KSASAN preetkaran20@gmail.com
1.0.3
jwt-alpha-1.0.3.zap
alpha
<ul>
<li>First version of JWT Support.
<ul>
<li>Contains scanning rules for basic JWT related vulnerabilities.</li>
<li>Contains JWT Fuzzer for fuzzing the JWT's present in the request.</li>
</ul>
</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/2.7/jwt-alpha-1.0.3.zap
SHA-256:d3df8480010ad2df230cbdb99619aafdb869861349455c3da0129a99b132d204
https://github.com/SasanLabs/owasp-zap-jwt-addon/
2023-01-02
751748
2.11.1
commonlib
fuzz
13.*
jython
Python Scripting
Allows Python to be used for ZAP scripting - templates included
ZAP Dev Team
15
jython-beta-15.zap
beta
<h3>Changed</h3>
<ul>
<li>Maintenance changes.</li>
<li>Update Active and Passive Script Templates to include a <code>getMetadata</code> function. This will allow them to be used as regular scan rules.</li>
<li>Depend on the <code>commonlib</code> add-on for scan rule scripts.</li>
<li>Update minimum <code>scripts</code> add-on version to 45.1.0.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/jython-v15/jython-beta-15.zap
SHA-256:019a64ba85cc9021a841e7253ae14f619129b603ab2048bec9593f5d59c1da02
https://www.zaproxy.org/docs/desktop/addons/python-scripting/
https://github.com/zaproxy/zap-extensions/
2024-04-11
43315501
2.14.0
commonlib
>=1.24.0
scripts
>=45.2.0
kotlin
Kotlin Support
Allows Kotlin to be used for ZAP scripting
StackHawk Engineering
1.1.0
kotlin-alpha-1.1.0.zap
alpha
<h3>Changed</h3>
<ul>
<li>Use appropriate syntax style for highlighting of code.</li>
<li>Update minimum ZAP version to 2.11.0.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/kotlin-v1.1.0/kotlin-alpha-1.1.0.zap
SHA-256:85a47ea7199b77cfb09081302c277de2ba5e2102ef79907573ebcfa6425302e9
https://www.zaproxy.org/docs/desktop/addons/kotlin-support/
https://github.com/zaproxy/zap-extensions/
2021-10-07
48865539
2.11.0
levoai
Levo.ai
Build OpenAPI Specs with ZAP traffic using Levo.ai.
Levo.ai
0.3.0
levoai-zap-addon-alpha-0.3.0.zap
alpha
<h3>Added</h3>
<ul>
<li>Option to configure an organization ID that is added as a header in the requests made to the Satellite.</li>
<li>Option to specify the environment under which the discovered apps will be shown in the Levo dashboard.</li>
<li>Set the sensor type in the requests made to the Satellite.</li>
</ul>
https://github.com/levoai/levoai-zap-addon/releases/download/v0.3.0/levoai-zap-addon-alpha-0.3.0.zap
SHA-256:1a86d7c288bf4284e83f54203f4ed8dd7d40b2bd47fbb8f8f853da67676269d2
https://levo.ai
https://github.com/levoai/levoai-zap-addon
2024-07-10
2465951
2.12.0
maplocal
Map Local
Allows mapping of responses to content of a chosen local file.
Keindel (Andrey Maksimov)
0.0.1
maplocal-alpha-0.0.1.zap
alpha
<ul>
<li>First version of Map Local extension. Provides feature to map Response Body to a content of chosen local file.
<ul>
<li>Has status panel in UI with 3 columns: Enabled / URL / Local Path.</li>
<li>Has add / edit dialog with browse button to choose file.</li>
<li>Has file choice verification check.</li>
<li>Popup menus in sites and history, edit / remove - popups in status panel.</li>
<li>Persists to session DB.</li>
</ul>
</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/2.7/maplocal-alpha-0.0.1.zap
SHA-256:d3ecd2a6e23b06ffed8646ee2314d921a1c1925c3ab08070a624a090734ebdca
https://github.com/Keindel/owasp-zap-maplocal-addon
2023-10-05
49040
2.12.0
neonmarker
Neonmarker
Colors history table items based on tags
Juha Kivekäs, Kingthorin
1.6.0
neonmarker-alpha-1.6.0.zap
alpha
<h3>Changed</h3>
<ul>
<li>Maintenance changes.</li>
<li>The script example in the Help content was updated to use the injected core variables instead of using the fully qualified class name.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>An NPE which could happen when removing an entry that didn't yet have a tag assigned.</li>
</ul>
https://github.com/kingthorin/neonmarker/releases/download/v1.6.0/neonmarker-alpha-1.6.0.zap
SHA-256:b6b1eef2673821189dee4877fe07cd78b64af662e3c6bff6e32c4f868b290ad3
https://www.zaproxy.org/docs/desktop/addons/neonmarker/
https://github.com/kingthorin/neonmarker
2023-08-17
35557
2.10.0
network
Network
Provides core networking capabilities.
ZAP Dev Team
0.18.0
network-beta-0.18.0.zap
beta
<h3>Added</h3>
<ul>
<li>Send success/failure stats.</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Stop retrying 429 and 503 responses, instead of waiting for <code>retry-after</code> (Issue 8627).</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix typo in log message.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/network-v0.18.0/network-beta-0.18.0.zap
SHA-256:cfae49285ac293ac13212e772a7f651b0d244bc6bfccf73a835f82e6f9e9d2b0
https://www.zaproxy.org/docs/desktop/addons/network/
https://github.com/zaproxy/zap-extensions/
2024-09-24
28118824
2.15.0
oast
OAST Support
Allows you to exploit out-of-band vulnerabilities
ZAP Dev Team
0.20.0
oast-beta-0.20.0.zap
beta
<h3>Added</h3>
<ul>
<li>API support.</li>
<li>Raise alerts for OAST interactions that happened in other sessions.</li>
<li>Options to trim the OAST permanent database.</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Depend on newer version of Database add-on.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Address warnings when using BOAST payloads.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/oast-v0.20.0/oast-beta-0.20.0.zap
SHA-256:93d0384912c9d64127e02b3114e82596406548f8b8152223fe5f0407cdff923e
https://www.zaproxy.org/docs/desktop/addons/oast-support/
https://github.com/zaproxy/zap-extensions/
2024-09-17
844324
2.15.0
database
>= 0.6.0
network
>= 0.1.0
onlineMenu
Online menus
ZAP Online menu items
ZAP Dev Team
13
onlineMenu-release-13.zap
release
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.15.0.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/onlineMenu-v13/onlineMenu-release-13.zap
SHA-256:c605e10c7c38c525d5dfe14f026fe6e11a26fb1055e681b51fd2e5bd576d5e1d
https://www.zaproxy.org/docs/desktop/addons/online-menu/
https://github.com/zaproxy/zap-extensions/
2024-05-07
208613
2.15.0
openapi
OpenAPI Support
Imports and spiders OpenAPI definitions.
ZAP Dev Team plus Joanna Bona, Nathalie Bouchahine, Artur Grzesica, Mohammad Kamar, Markus Kiss, Michal Materniak, Marcin Spiewak, and SDA SE Open Industry Solutions
43
openapi-beta-43.zap
beta
<h3>Added</h3>
<ul>
<li>Allow to import the OpenAPI definitions with a user (Issue 7739).</li>
<li>Honour context exclusions when importing (Issue 8021).</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Allow to select the contexts of the Automation Framework plan when configuring the job.</li>
<li>Correctly handle empty context name in the Automation Framework job.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/openapi-v43/openapi-beta-43.zap
SHA-256:f72b0061547ec3e72f6e9e3ec83a86c730e48208788acf10b690fa456866ef73
https://www.zaproxy.org/docs/desktop/addons/openapi-support/
https://github.com/zaproxy/zap-extensions/
2024-09-23
11513623
2.15.0
commonlib
>= 1.26.0 & < 2.0.0
packpentester
Collection: Pentester Pack
A collection of add-ons ideal for pentesters
ZAP Dev Team
0.1.0
packpentester-alpha-0.1.0.zap
alpha
<h3>Fixed</h3>
<ul>
<li>Corrected fuzz add-on name</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/packpentester-v0.1.0/packpentester-alpha-0.1.0.zap
SHA-256:0b8e7e4ddffdcacf46fdf9793bf84217738e281cbd5ccac732788c4b768d069c
https://www.zaproxy.org/docs/desktop/addons/collection-pentester-pack/
https://github.com/zaproxy/zap-extensions/
2022-05-12
6792
2.11.1
accessControl
attacksurfacedetector
custompayloads
evalvillain
fileupload
fuzz
fuzzdb
jsonview
jwt
requester
viewstate
wappalyzer
packscanrules
Collection: Scan Rules Pack
All of the add-ons just containing release, beta and alpha status scan rules
ZAP Dev Team
0.0.1
packscanrules-alpha-0.0.1.zap
alpha
<p>First version.</p>
https://github.com/zaproxy/zap-extensions/releases/download/packscanrules-v0.0.1/packscanrules-alpha-0.0.1.zap
SHA-256:5ad68f153379bd96f36a7bead61e884cc42e1409cdd262dffc682b5f7bf92da4
https://www.zaproxy.org/docs/desktop/addons/collection-scan-rules-pack/
https://github.com/zaproxy/zap-extensions/
2022-05-13
9244
2.11.1
ascanrules
ascanrulesAlpha
ascanrulesBeta
domxss
pscanrules
pscanrulesAlpha
pscanrulesBeta
retire
paramdigger
Parameter Digger
Identify hidden, unlinked parameters. Useful for finding web cache poisoning vulnerabilities.
ZAP Dev Team and Arkaprabha Chakraborty
0.3.0
paramdigger-alpha-0.3.0.zap
alpha
<h3>Added</h3>
<ul>
<li>Support for menu weights (Issue 8369)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Maintenance changes.</li>
<li>Update minimum ZAP version to 2.15.0.</li>
<li>The output panel is now properly reset on ZAP session change (part of Issue 7694).</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/paramdigger-v0.3.0/paramdigger-alpha-0.3.0.zap
SHA-256:585e4853c7cbc3c925ea4d5e1cfbcd6d8a3d4a20b00bdd49f582743cc6a9e281
https://www.zaproxy.org/docs/desktop/addons/parameter-digger/
https://github.com/zaproxy/zap-extensions/
2024-07-15
561541
2.15.0
commonlib
>= 1.23.0 & < 2.0.0
plugnhack
Plug-n-Hack Configuration
Supports the Mozilla Plug-n-Hack standard: https://developer.mozilla.org/en-US/docs/Plug-n-Hack.
ZAP Dev Team
13
plugnhack-beta-13.zap
beta
<h3>Changed</h3>
<ul>
<li>Maintenance changes.</li>
<li>Update minimum ZAP version to 2.12.0.</li>
<li>Use Network add-on to obtain main proxy address/port.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/plugnhack-v13/plugnhack-beta-13.zap
SHA-256:8d74b572bb7e08d09ebcfd10da9f2f65f7970f9452feadb8bbe69c8037b80ee2
https://www.zaproxy.org/docs/desktop/addons/plug-n-hack/
https://github.com/zaproxy/zap-extensions/
2022-10-27
736005
2.12.0
network
>= 0.2.0
postman
Postman Support
Imports and spiders Postman collections.
ZAP Dev Team
0.4.0
postman-alpha-0.4.0.zap
alpha
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.15.0.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/postman-v0.4.0/postman-alpha-0.4.0.zap
SHA-256:c2b15b51ded5d40779d8218b37b4d2bf5632a0b077c9ad7ee7d25c8106451556
https://www.zaproxy.org/docs/desktop/addons/postman-support/
https://github.com/zaproxy/zap-extensions/
2024-05-07
282072
2.15.0
commonlib
>= 1.16.0 & < 2.0.0
pscan
Passive Scanner
Provides core passive scanning capabilities.
ZAP Dev Team
0.0.1
pscan-alpha-0.0.1.zap
alpha
<h3>Added</h3>
<ul>
<li>Provide the Passive Rules script type (Issue 7959).</li>
<li>Provide the Stats Passive Scan Rule (Issue 7959).</li>
<li>Provide the scan status label (Issue 7959).</li>
<li>Provide the <code>pscan</code> API on newer ZAP versions (Issue 7959).</li>
<li>Dynamically un/load add-on passive scan rules (Issue 7959).</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/pscan-v0.0.1/pscan-alpha-0.0.1.zap
SHA-256:16ac6f30ff5fe46d2933978b4be88cf43a6c94db0d13d9c4dbf7beab57ac769a
https://www.zaproxy.org/docs/desktop/addons/passive-scanner/
https://github.com/zaproxy/zap-extensions/
2024-09-02
69688
2.15.0
pscanrules
Passive scanner rules
The release status Passive Scanner rules
ZAP Dev Team
61
pscanrules-release-61.zap
release
<h3>Changed</h3>
<ul>
<li>Maintenance changes.</li>
<li>Rename Mac OSX salted SHA-1 in the Hash Disclosure scan rule to "Salted SHA-1", reduce the associated alerts to Low risk and Low confidence, to align with other SHA related patterns it will only be evaluated a Low Threshold. (Note such matches may indicate leaks related but not limited to: MacOS X, Oracle, Tiger-192, Haval-192) (Issue 8624).</li>
<li>The Insecure JSF ViewState now includes example alert functionality for documentation generation purposes (Issue 6119).</li>
<li>The Absence of Anti-CSRF Tokens scan rule now only considers GET requests at Low Threshold (Issue 7741).</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/pscanrules-v61/pscanrules-release-61.zap
SHA-256:419ce3e8057be1542cb6605539f0ffb41ed77ef45dae5c81dfcf8b99290dd30b
https://www.zaproxy.org/docs/desktop/addons/passive-scan-rules/
https://github.com/zaproxy/zap-extensions/
2024-09-24
1919217
2.15.0
commonlib
>= 1.17.0 & < 2.0.0
pscan
pscanrulesAlpha
Passive scanner rules (alpha)
The alpha status Passive Scanner rules
ZAP Dev Team
43
pscanrulesAlpha-alpha-43.zap
alpha
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.15.0.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Alert text for various rules has been updated to more consistently use periods and spaces in a uniform manner.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/pscanrulesAlpha-v43/pscanrulesAlpha-alpha-43.zap
SHA-256:753feca8952877c7da72cbbdd54940d05f6b7e59324164e05aa9611d3f872746
https://www.zaproxy.org/docs/desktop/addons/passive-scan-rules-alpha/
https://github.com/zaproxy/zap-extensions/
2024-09-02
560614
2.15.0
commonlib
>= 1.17.0 & < 2.0.0
pscanrulesBeta
Passive scanner rules (beta)
The beta status Passive Scanner rules
ZAP Dev Team
41
pscanrulesBeta-beta-41.zap
beta
<h3>Fixed</h3>
<ul>
<li>A possible false positive condition with the Dangerous JS Functions scan rule with substrings in certain circumstances (Issue 8553).</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/pscanrulesBeta-v41/pscanrulesBeta-beta-41.zap
SHA-256:afb76940929bf4f3bf2ab4a2d0a0fa9d50ef834969b551c5397459746caf6e76
https://www.zaproxy.org/docs/desktop/addons/passive-scan-rules-beta/
https://github.com/zaproxy/zap-extensions/
2024-09-02
677612
2.15.0
commonlib
>= 1.10.0 & < 2.0.0
quickstart
Quick Start
Provides a tab which allows you to quickly test a target application
ZAP Dev Team
50
quickstart-release-50.zap
release
<h3>Changed</h3>
<ul>
<li>Rebrand to ZAP by Checkmarx.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/quickstart-v50/quickstart-release-50.zap
SHA-256:4aa931edfd9a3139c566b22ed367310d0f5da21e4743ce7cf9306f86c4f5e81c
https://www.zaproxy.org/docs/desktop/addons/quick-start/
https://github.com/zaproxy/zap-extensions/
2024-09-24
781958
2.15.0
callhome
>= 0.0.1
network
>= 0.3.0
reports
>= 0.4.0
reflect
Reflect
Finds reflected parameters
Caleb Kinney
0.0.11
reflect-alpha-0.0.11.zap
alpha
https://github.com/zaproxy/zap-extensions/releases/download/2.7/reflect-alpha-0.0.11.zap
SHA-256:c45307037042e4079546a5fcb17d1165475e5cdd5ba7e8abc0d2cf0a14866466
https://github.com/TypeError/reflect/
2021-02-19
1780219
2.9.0
regextester
Regular Expression Tester
Allows to test Regular Expressions
ZAP Dev Team
2
regextester-alpha-2.zap
alpha
<h3>Added</h3>
<ul>
<li>Add help.</li>
<li>Add info and repo URLs.</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.11.0.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Close dialogues when the add-on is uninstalled.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/regextester-v2/regextester-alpha-2.zap
SHA-256:b4706709c16a45e8bedc0bd6f28dd09532d5dbf3f1fe2c2853e20dbf6160a584
https://www.zaproxy.org/docs/desktop/addons/regular-expression-tester/
https://github.com/zaproxy/zap-extensions/
2021-10-07
159441
2.11.0
replacer
Replacer
Easy way to replace strings in requests and responses.
ZAP Dev Team
19
replacer-release-19.zap
release
<h3>Changed</h3>
<ul>
<li>Update ZAP API endpoint description.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/replacer-v19/replacer-release-19.zap
SHA-256:82364e97bfbfa4a8ed6ae06f2527b5884138bd8c8da05bf616ae659a6c619bf7
https://www.zaproxy.org/docs/desktop/addons/replacer/
https://github.com/zaproxy/zap-extensions/
2024-10-07
445317
2.15.0
reports
Report Generation
Official ZAP Reports.
ZAP Dev Team
0.34.0
reports-release-0.34.0.zap
release
<h3>Changed</h3>
<ul>
<li>Checkmarx rebrand.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>An issue where alert details were missing from some Risk and Confidence HTML reports (Issue 8460).</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/reports-v0.34.0/reports-release-0.34.0.zap
SHA-256:2326fb78d2fa4e03bcbdc31e872c0800a244a882e40374ab84d1a06ae43e15c1
https://www.zaproxy.org/docs/desktop/addons/report-generation/
https://github.com/zaproxy/zap-extensions/
2024-10-07
14786287
2.15.0
commonlib
>= 1.17.0 & < 2.0.0
requester
Requester
Allows to manually edit and send messages.
Surikato and the ZAP Dev Team
7.7.0
requester-beta-7.7.0.zap
beta
<h3>Added</h3>
<ul>
<li>Allow to display a message in the editor dialogue.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/requester-v7.7.0/requester-beta-7.7.0.zap
SHA-256:4b48f337b548d2170e5c8d15e3cf0b9e7dd5ea5fe359bc68426b6bf8f5da665d
https://www.zaproxy.org/docs/desktop/addons/requester/
https://github.com/zaproxy/zap-extensions/
2024-06-28
763092
2.15.0
commonlib
>=1.23.0
retest
Retest
An add-on to retest for presence/absence of previously generated alerts.
ZAP Dev Team
0.10.0
retest-alpha-0.10.0.zap
alpha
<h3>Changed</h3>
<ul>
<li>Use the Passive Scanner add-on for the Automation Framework passive scan jobs (Issue 7959).</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/retest-v0.10.0/retest-alpha-0.10.0.zap
SHA-256:dc07cf2a8a2ffa066d3289a8f8dd1ece1d44b826afdb1039b9dfade670b65744
https://www.zaproxy.org/docs/desktop/addons/retest/
https://github.com/zaproxy/zap-extensions/
2024-09-02
259174
2.15.0
automation
>=0.42.0
commonlib
>= 1.17.0 & < 2.0.0
pscan
retire
Retire.js
Use Retire.js to identify vulnerable or out-dated JavaScript packages.
Nikita Mundhada and the ZAP Dev Team
0.42.0
retire-release-0.42.0.zap
release
<h3>Changed</h3>
<ul>
<li>Updated with upstream retire.js pattern changes.</li>
<li>The Risk level associated with Alerts raised by this scan rule are mapped to the severity ratings provided in the Retire.js data. If no severity is matched then a default of Medium Risk is used (Issue 7926).</li>
<li>Maintenance changes.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/retire-v0.42.0/retire-release-0.42.0.zap
SHA-256:e43d8eedc67af0ca34502cc39ad18a75043b8719ff882babd67069072fbe6bd1
https://www.zaproxy.org/docs/desktop/addons/retire.js/
https://github.com/zaproxy/zap-extensions/
2024-11-25
994720
2.15.0
commonlib
>= 1.16.0 & < 2.0.0
reveal
Reveal
Show hidden fields and enable disabled fields
ZAP Dev Team
8
reveal-release-8.zap
release
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.15.0.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/reveal-v8/reveal-release-8.zap
SHA-256:f032e8dcce4b6d089a3e0006bee87483035c93f6da1b9609ba9d3a641f870bde
https://www.zaproxy.org/docs/desktop/addons/reveal/
https://github.com/zaproxy/zap-extensions/
2024-05-07
238692
2.15.0
revisit
Revisit
Revisit a site at any time in the past using the session history
ZAP Dev Team
5
revisit-alpha-5.zap
alpha
<h3>Changed</h3>
<ul>
<li>Maintenance changes.</li>
<li>Update minimum ZAP version to 2.14.0.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Prevent exception when processing history after deleting messages.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/revisit-v5/revisit-alpha-5.zap
SHA-256:cdaf29b98bab8f5f899840950974837122bab6f00a9dc7ec72aecdffd6b83c02
https://www.zaproxy.org/docs/desktop/addons/revisit/
https://github.com/zaproxy/zap-extensions/
2023-10-23
302425
2.14.0
saml
SAML Support
Detect, Show, Edit, Fuzz SAML requests
ZAP Dev Team
10
saml-alpha-10.zap
alpha
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.12.0.</li>
<li>Maintenance changes.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/saml-v10/saml-alpha-10.zap
SHA-256:097492271c7ec1d85def81091ffe897f4809927043844d1f5f0c7c598a0ad164
https://www.zaproxy.org/docs/desktop/addons/saml-support/
https://github.com/zaproxy/zap-extensions/
2022-10-28
1811985
2.12.0
scanpolicies
Scan Policies
A set of standard scan policies.
ZAP Dev Team
0.1.0
scanpolicies-alpha-0.1.0.zap
alpha
<h3>Added</h3>
<ul>
<li>A set of standardized active scan policies:
<ul>
<li>Default Policy</li>
<li>Developer CI/CD</li>
<li>Developer Standard</li>
<li>Developer Full</li>
<li>QA Standard</li>
<li>QA Full</li>
<li>API</li>
</ul>
</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/scanpolicies-v0.1.0/scanpolicies-alpha-0.1.0.zap
SHA-256:c9077c973ccaed3e886908c5536bb51dc67f98765a43eebf641e31490a3deb15
https://www.zaproxy.org/docs/desktop/addons/scan-policies/
https://github.com/zaproxy/zap-extensions/
2024-11-27
17453
2.15.0
scripts
Script Console
Supports all JSR 223 scripting languages
ZAP Dev Team
45.7.0
scripts-release-45.7.0.zap
release
<h3>Fixed</h3>
<ul>
<li>Reuse script cache for all passive scan threads to avoid recompilation of Passive Rules scripts.</li>
<li>Address a concurrency issue when using Graal.js Passive Rules scripts as first-class scan rules.</li>
<li>Handle gracefully the inability to force stop the running standalone script in newer Java versions.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/scripts-v45.7.0/scripts-release-45.7.0.zap
SHA-256:2d19eaadabaa80b1628fec9ff884a92542709f36a3ac339d5ccc259b366b28c7
https://www.zaproxy.org/docs/desktop/addons/script-console/
https://github.com/zaproxy/zap-extensions/
2024-10-07
5190598
2.15.0
commonlib
>=1.25.0
selenium
Selenium
WebDriver provider and includes HtmlUnit browser
ZAP Dev Team
15.30.0
selenium-release-15.30.0.zap
release
<h3>Changed</h3>
<ul>
<li>Update Selenium to version 4.25.0.</li>
<li>Update script template:
<ul>
<li>selenium/Selenium default template.js - update documentation.</li>
</ul>
</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/selenium-v15.30.0/selenium-release-15.30.0.zap
SHA-256:540709b714e2ed0a68fc4ff04fbc0cb3db29faf4ce1d4043f8e086c66cc083a7
https://www.zaproxy.org/docs/desktop/addons/selenium/
https://github.com/zaproxy/zap-extensions/
2024-09-24
31622033
2.15.0
commonlib
>=1.23.0
network
>=0.2.0
sequence
Sequence
Gives the possibility of defining a sequence of requests to be scanned.
ZAP Dev Team
7
sequence-alpha-7.zap
alpha
<h3>Changed</h3>
<ul>
<li>Maintenance changes.</li>
<li>Update minimum ZAP version to 2.14.0.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Prevent exception if no display (Issue 3978).</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/sequence-v7/sequence-alpha-7.zap
SHA-256:422d278ae7619f02adec8a43e997443a04b0d3f00e44fffd64e556b2f1941a4d
https://www.zaproxy.org/docs/desktop/addons/sequence-scanner/
https://github.com/zaproxy/zap-extensions/
2023-10-23
1558728
2.14.0
zest
soap
SOAP Support
Imports and scans WSDL files containing SOAP endpoints.
Alberto (albertov91) + ZAP Dev Team
23
soap-beta-23.zap
beta
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.15.0.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/soap-v23/soap-beta-23.zap
SHA-256:9bc1db945434853af2ba11100bc35df430cd3f1c48cadb385ea024351f7c6a6f
https://www.zaproxy.org/docs/desktop/addons/soap-support/
https://github.com/zaproxy/zap-extensions/
2024-05-07
12906740
2.15.0
commonlib
>= 1.17.0 & < 2.0.0
spider
Spider
Spider used for automatically finding URIs on a site.
ZAP Dev Team
0.12.0
spider-release-0.12.0.zap
release
<h3>Added</h3>
<ul>
<li>Allow the parsers to obtain the context and user being used by/in the current spidering scan (Issue 8021 and 7739).</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Maintenance changes.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/spider-v0.12.0/spider-release-0.12.0.zap
SHA-256:d9773e50eafc24778f41ad7b9b51c97611d781660db42dbf17ba96f4b0105f38
https://www.zaproxy.org/docs/desktop/addons/spider/
https://github.com/zaproxy/zap-extensions/
2024-09-23
1157784
2.15.0
commonlib
>= 1.23.0 & < 2.0.0
database
network
>=0.3.0
spiderAjax
Ajax Spider
Allows you to spider sites that make heavy use of JavaScript using Crawljax
ZAP Dev Team
23.21.0
spiderAjax-release-23.21.0.zap
release
<h3>Changed</h3>
<ul>
<li>Maintenance changes related to Passive Scanner add-on (Issue 7959).</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/spiderAjax-v23.21.0/spiderAjax-release-23.21.0.zap
SHA-256:71ce97cf4a95dcdd9a4054091cc2165f5dca834461b5404caf7c439739c5a441
https://www.zaproxy.org/docs/desktop/addons/ajax-spider/
https://github.com/zaproxy/zap-extensions/
2024-09-02
7568075
2.15.0
commonlib
>= 1.23.0 & < 2.0.0
network
>=0.11.0
selenium
15.*
sqliplugin
Advanced SQLInjection Scanner
An advanced active injection bundle for SQLi (derived by SQLMap)
Andrea Pompili (Yhawke)
15
sqliplugin-beta-15.zap
beta
<h3>Fixed</h3>
<ul>
<li>Re-ordered variable initialization to prevent an NPE.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/sqliplugin-v15/sqliplugin-beta-15.zap
SHA-256:76e857bd2fea0b57b641862ea5bef46365ac1b03a19371c5e818a5401f7d9384
https://www.zaproxy.org/docs/desktop/addons/advanced-sqlinjection-scanner/
https://github.com/zaproxy/zap-extensions/
2021-10-20
534349
2.11.0
commonlib
>= 1.5.0 & < 2.0.0
sse
Server-Sent Events
Allows you to view Server-Sent Events (SSE) communication.
ZAP Dev Team
13
sse-alpha-13.zap
alpha
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.15.0.</li>
<li>Maintenance changes.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>More gracefully handle missing value for "id" field (Issue 8320)</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/sse-v13/sse-alpha-13.zap
SHA-256:38cf84e00664287e691606f473343ba0c0db0711c4f895312d0d482c3354731b
https://www.zaproxy.org/docs/desktop/addons/server-sent-events/
https://github.com/zaproxy/zap-extensions/
2024-05-21
330079
2.15.0
svndigger
SVN Digger Files
SVN Digger files which can be used with ZAP forced browsing
ZAP Dev Team
4
svndigger-release-4.zap
release
<h3>Added</h3>
<ul>
<li>Add help.</li>
<li>Add repo URL.</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.11.0.</li>
<li>Promote to release status.</li>
<li>Change info URL to link to the site.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/svndigger-v4/svndigger-release-4.zap
SHA-256:5556efdf3fdb84ebd6cf3e76ca31e3fb6fb57c002cf14b2cf2f05f67bf2b622a
https://www.zaproxy.org/docs/desktop/addons/svn-digger-files/
https://github.com/zaproxy/zap-extensions/
2021-10-07
713963
2.11.0
tips
Tips and Tricks
Display ZAP Tips and Tricks
ZAP Dev Team
13
tips-beta-13.zap
beta
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.15.0.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/tips-v13/tips-beta-13.zap
SHA-256:508e06e6b8c0ed026b079f5788c475943be69d5a9ce422956a0fcccc3c709a4a
https://www.zaproxy.org/docs/desktop/addons/tips-and-tricks/
https://github.com/zaproxy/zap-extensions/
2024-05-07
572495
2.15.0
tokengen
Token Generation and Analysis
Allows you to generate and analyze pseudo random tokens, such as those used for session handling or CSRF protection
ZAP Dev Team
15
tokengen-beta-15.zap
beta
<h3>Changed</h3>
<ul>
<li>Now using 2.10 logging infrastructure (Log4j 2.x).</li>
<li>Maintenance changes.</li>
<li>Update minimum ZAP version to 2.11.0.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/tokengen-v15/tokengen-beta-15.zap
SHA-256:daef1d13d44a76b8735a30ed9e1e50fa87a85d02728bd7ae575197d173f942f9
https://www.zaproxy.org/docs/desktop/addons/token-generator/
https://github.com/zaproxy/zap-extensions/
2021-10-07
525206
2.11.0
treetools
TreeTools
Tools to add functionality to the tree view.
Carl Sampson
8
treetools-beta-8.zap
beta
<h3>Added</h3>
<ul>
<li>Add help.</li>
<li>Add info and repo URLs.</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.11.0.</li>
<li>Maintenance changes.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/treetools-v8/treetools-beta-8.zap
SHA-256:b7f61f8939937ebc120bce8deb72713d7676087056e88801df2573112e7642e4
https://www.zaproxy.org/docs/desktop/addons/treetools/
https://github.com/zaproxy/zap-extensions/
2021-10-07
128931
2.11.0
viewstate
ViewState
ASP/JSF ViewState Decoder and Editor
Calum Hutton
3
viewstate-alpha-3.zap
alpha
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.11.0.</li>
<li>Maintenance changes.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/viewstate-v3/viewstate-alpha-3.zap
SHA-256:715caefd591415e79b32195361fea82aa8c6357b24e69530c22fde0a1b6dad17
https://www.zaproxy.org/docs/desktop/addons/viewstate/
https://github.com/zaproxy/zap-extensions/
2021-10-07
148716
2.11.0
wappalyzer
Technology Detection
Technology detection using various fingerprints and identifiers.
ZAP Dev Team
21.43.0
wappalyzer-release-21.43.0.zap
release
<h3>Changed</h3>
<ul>
<li>Updated with enthec upstream icon and pattern changes.</li>
<li>Maintenance changes.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/wappalyzer-v21.43.0/wappalyzer-release-21.43.0.zap
SHA-256:f5bf3028d5a9bc262f522b920c9012a542d84e75b4429919c3eeb12851127c7b
https://www.zaproxy.org/docs/desktop/addons/technology-detection/
https://github.com/zaproxy/zap-extensions/
2024-11-25
19759181
2.15.0
commonlib
>= 1.17.0 & < 2.0.0
webdriverlinux
Linux WebDrivers
Linux WebDrivers for Firefox and Chrome.
ZAP Dev Team
115
webdriverlinux-release-115.zap
release
<h3>Changed</h3>
<ul>
<li>Update ChromeDriver to 131.0.6778.85.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/webdriverlinux-v115/webdriverlinux-release-115.zap
SHA-256:a043122be141aa9f4f69a1a857da5323d3b109aac485b132585186c30b1e73ca
https://www.zaproxy.org/docs/desktop/addons/linux-webdrivers/
https://github.com/zaproxy/zap-extensions/
2024-11-20
15869377
2.15.0
webdrivermacos
MacOS WebDrivers
MacOS WebDrivers for Firefox and Chrome.
ZAP Dev Team
115
webdrivermacos-release-115.zap
release
<h3>Changed</h3>
<ul>
<li>Update ChromeDriver to 131.0.6778.85.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/webdrivermacos-v115/webdrivermacos-release-115.zap
SHA-256:1ef5dff72f8234435029b5e15345fe9080d9af958efe75fc907b821b4ca5faa5
https://www.zaproxy.org/docs/desktop/addons/macos-webdrivers/
https://github.com/zaproxy/zap-extensions/
2024-11-20
22527656
2.15.0
webdriverwindows
Windows WebDrivers
Windows WebDrivers for Firefox and Chrome.
ZAP Dev Team
115
webdriverwindows-release-115.zap
release
<h3>Changed</h3>
<ul>
<li>Update ChromeDriver to 131.0.6778.85.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/webdriverwindows-v115/webdriverwindows-release-115.zap
SHA-256:652c793cbe8f4d375ee4c94ec5421de454e329bd140a2efd4fb0a8aee0d8692d
https://www.zaproxy.org/docs/desktop/addons/windows-webdrivers/
https://github.com/zaproxy/zap-extensions/
2024-11-20
20420918
2.15.0
websocket
WebSockets
Allows you to inspect WebSocket communication.
ZAP Dev Team
31
websocket-release-31.zap
release
<h3>Added</h3>
<ul>
<li>Support for menu weights (Issue 8369)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Update minimum ZAP version to 2.15.0.</li>
<li>Maintenance changes.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/websocket-v31/websocket-release-31.zap
SHA-256:2db8ed7f7819a0c17b8b35edeab70e3ef987da87589ab084e066f42af6ce203d
https://www.zaproxy.org/docs/desktop/addons/websockets/
https://github.com/zaproxy/zap-extensions/
2024-05-07
1398957
2.15.0
commonlib
>=1.23.0
zest
Zest - Graphical Security Scripting Language
A graphical security scripting language, ZAPs macro language on steroids
ZAP Dev Team
47
zest-beta-47.zap
beta
<h3>Fixed</h3>
<ul>
<li>Correctly handle added scripts with no engine name.</li>
</ul>
https://github.com/zaproxy/zap-extensions/releases/download/zest-v47/zest-beta-47.zap
SHA-256:92196504924b2fc07a8a26d056538dd63c7d94988938b074386a5a08bd4c4616
https://www.zaproxy.org/docs/desktop/addons/zest/
https://github.com/zaproxy/zap-extensions/
2024-09-24
5610274
2.15.0
commonlib
>=1.24.0
network
>=0.2.0
scripts
>=45.2.0
selenium
>= 15.13.0