Skip to content

HelpStartConceptsDdc

psiinon edited this page Dec 4, 2015 · 1 revision

Data Driven Content

Data driven content is type of Structural Modifier which identifies URL paths that represent data.

In 'traditional' web applications the structure of the application is typically defined by the URL paths and the data is contained in the URL parameters and POST data. URLs like:

are represented in the Sites tab as two 'nodes' in the tree:

The Sites tree is very important as it reflects ZAP's understanding of the application structure. If it is not a good representation of the structure then ZAP will not be able to attack the application effectively.

Some applications include data in URL paths. For example:

These 3 URLs represent the same page but with different data, but by default ZAP will represent them as three separate nodes:

This is a problem because ZAP will now attack all 3 pages when it only needs to attack one of them. In this case attacking the same page 3 times is not a big problem, but if you have hundreds or thousands of pages like this will significantly increase the time it takes to scan the application.

In ZAP terms the 'company' nodes are 'data driven content' - URL path elements that contain data instead of representing part of the application structure. You can define data driven content by adding the application to a Context and then configuring them via the Sites tab 'Flag as Context -> Context Name Data driven node' right click menu item Once you have done this the pages will be correctly represented as 1 node:

The characters « and » are used to indicate that this is a 'special' node and the node name (in this case 'company') can be set by you to indicate what that node represents.

Accessed via

     Sites tab 'Flag as Context -> Context Name Data driven node' right click menu item
     History tab 'Flag as Context -> Context Name Data driven node' right click menu item

See also

     UI Overview for an overview of the user interface
     Features provided by ZAP
     Structural Parameters which identify parameters that represent application structure instead of user data
     Session Context Structure screen
Clone this wiki locally
You can’t perform that action at this time.