I’m using Zap Proxy within a Docker container defined by this Dockerfile:

FROM softwaresecurityproject/zap-bare

ENV ZAP_AUTO_UPDATE=false

EXPOSE 9090

CMD ["sh", "-c", "nohup zap.sh -daemon -port 9090 -config api.disablekey=true -config api.addrs.addr.name=.* -config api.addrs.addr.regex=true -config view.mode=attack -host 0.0.0.0 -config network.localServers.mainProxy.behindNat=true -config network.connection.timeOutInSecs=120 -config network.httpState.timeoutInSecs=120 -config log.level=DEBUG & sleep 60 && curl 'http://localhost:9090/JSON/context/action/newContext/?contextName=ZAP_CONTEXT' && tail -f /dev/null"]

I’m intrigued by Zap’s capability to inspect both request (headers and body) and response (headers and body) for each attack. For instance, I want to examine the request body of a SQL-Injection attack and analyze how my API responds to it.

Despite setting the logging level to DEBUG, I’m currently unable to capture the HTTP request and response for each attack during an active scan. With the current setup, all I see in the logs are entries like this:

2024-06-27 13:09:25 318242 [ZAP-Scanner-1] INFO org.parosproxy.paros.core.scanner.HostProcess - start host https://my-service.com | RemoteFileIncludeScanRule strength MEDIUM threshold MEDIUM