18
ZAP script took 3 hours to run on our staging app in Denver
Last week I let OWASP ZAP do a full active scan against our staging instance, and it hammered the server so hard the API started timing out. We had to whitelist the scan IP and throttle it to 1 request per second. Has anyone else hit performance issues running scans against internal apps, and what configs worked for you?
1 comments
Log in to join the discussion
Log In1 Comment
the_laura5d ago
...and honestly that tracks with what I heard from a friend who does app sec consulting. He stopped letting ZAP run straight out of the box against anything with real traffic because the default spider alone can spiral out of control. What worked for him was splitting the scan into pieces, like doing the AJAX spider in one window and then the active scan with a custom policy that only targets the risky stuff, SQLi and XSS, not every passive check. Also setting a hard max duration and using the built in rate limiting option instead of just hoping the server handles it. The Denver thing is a pain too because latency and local network weirdness can make ZAP think it's getting timeouts when it's actually just slow, so he always bumps the timeout settings up for cloud hosted stuff. Take that with a grain of salt though, every app is different and sometimes you just gotta babysit the first run to see where it chokes.
6