Is there a way to check how scan and fuzz commands work at backend in ZAP?

Question

We have a requirement to know how commands works at backend when triggered via OWASP ZAP Tool.

This will help for data visualizing & interaction with ZAP and UI.

For example:

1. Commands like 'active scan'
2. In ZAP Tool we select required site and click on 'Active Scan' action
3. Active scan happens and the result appears in history tab.

Now requirement is to visualize how the commands interact at the background when user clicks on 'Active Scan' from ZAP tool.

How it reads the request, process the data and generate result back in ZAP tool?

Similarly for passive scan and fuzzing.

Answer 1

The code is all Open Source. Please refer to the two primary repositories:

Core: https://github.com/zaproxy/zaproxy Extensions: https://github.com/zaproxy/zap-extensions

Answer 2

Also see https://www.zaproxy.org/tags/hacking/ and if you have specific questions then its best to add them on the ZAP Dev Group