Skip to content
The OWASP ZAP Heads Up Display (HUD)
Java JavaScript CSS HTML Kotlin Haskell
Branch: develop
Clone or download
Latest commit 1cd16e7 Dec 2, 2019
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
.github/workflows Update GitHub Action workflow Oct 16, 2019
assets/images Fixed logo so its not cropped Mar 18, 2019
buildSrc Generate code coverage report for tutorial tests Oct 24, 2019
gradle Update Gradle and add-on plugin May 20, 2019
lib Switch to gradle and add initial selenium tests Oct 11, 2018
src Alert i18n bug #235 FIXED Nov 29, 2019
.gitattributes Correct gitattributes May 13, 2019
.gitignore Use Gradle to build the add-on Oct 25, 2018
.lgtm.yml
.sonarcloud.properties
.travis.yml
CHANGELOG.md Alert i18n bug #235 FIXED Nov 29, 2019
CONTRIBUTING.md Add CONTRIBUTING.md file May 2, 2019
LICENSE
README.md
build.gradle.kts Prepare for next version Nov 25, 2019
gradlew Use org.zaproxy.add-on plugin Mar 13, 2019
gradlew.bat Use org.zaproxy.add-on plugin Mar 13, 2019
package-lock.json Bump vue-i18n from 8.15.0 to 8.15.1 Nov 28, 2019
package.json
settings.gradle.kts

README.md

HUD Logo OWASP ZAP Heads Up Display

Release: Beta Known Vulnerabilities Total alerts Language grade: JavaScript

Welcome to the HUD

The HUD is new interface that provides the functionality of ZAP directly in the browser.

Learn more:

Using the HUD

Downloading

You can try out ZAP enabled with the HUD via any of:

or

  • Run it from this repo using:
    git clone https://github.com/zaproxy/zap-hud.git
    cd zap-hud
    ./gradlew runZap
    

In all cases you will need Java 8+ installed.

You'll see the HUD Radar icon Radar Icon in the tool bar. When the icon is selected the HUD will be added to your browser.

Toolbar with Radar

Starting the HUD

  1. Quick Start: Select either Firefox or Chrome on the Quick Start tab and click on the Launch Browser button.

  1. Manually: You can also configure Firefox or Chrome to proxy via ZAP manually, but you will need to import the ZAP Root CA Certificate.

The first time the HUD is launched you'll be prompted with the HUD Tutorial. We recommend that you follow the tutorial even if you have read the above blog post and watched the video.

Getting Involved

ZAP is a community project and so we are always very keen to hear from anyone who'd like to contribute, just post to the ZAP HUD Group

We'd also love to hear some feedback, which you can also give via that group.

Limitations

This is still early days and there are some known issues and limitations with the current release. Development on the HUD is very active and we recommend you check in often for new features and improvements. :)

You should NOT use it on sites you do not trust! However it is in scope for the ZAP bug bounty on BugCrowd

Limitations while running:

  • Only a limited amount of ZAP functionality is available
  • Firefox has been tested more than Chrome, but both should work (JxBrowser, doesn't currently work)
  • The code to support the HUD in multiple browser tabs is very new so might be buggy
    • In particular don't close the first tab on Firefox or the HUD will stop working (weird, we know. See #199 for details)
  • Using the HUD with browser dev tools open can significantly affect performance
  • Behaviour using the browser back button is currently undefined

Issues and todos in code:

  • We're using Vue.js in dev mode, which prevents us from using a suitably strong CSP
  • JavaScript code still needs to be formatted and linted
  • Documentation could, of course, be better
  • Async functions are handled as via Promises as opposed to using 'await' pattern

These lists aren't exhaustive, but do highlight some of the larger restrictions.

You can’t perform that action at this time.