out of scope error shown in ajax spider attack in zap

Question

I am using OWASP ZAP for security testing. I tried to do Ajax spider attack on my admin dashboard page. But in the message, out of scope is shown and browser is also not opening. What shall I do to fix this and open browser and to perform this test?

Answer 1

By default ZAP will only follow URLs that are in the same domain, otherwise it could end up trying to spider the whole internet :)

Look at the URLs it is reporting - 'http://detectportal.firefox.com/success.txt' - these are not in the same domain as your app, and are almost certainly not part of it.

So thats not the problem. Which browser and version are you using? Have you checked that ZAP is up to date?

You'll probably get more (and faster) help on the ZAP User Group :) https://groups.google.com/group/zaproxy-users

Answer 2

I tried again by re-installing ZAP. then it worked fine as shown in screenshot. also the webpage is opened in the browser.