Search code examples
proxyowaspzappenetration-testingburp

How to use spider in Burp through ZAP?

Burp Community Edition from version 2.x doesn't have the scanning/spidering as a free option.

Is it possible to use spidering in Burp Community Edition using ZAP as a proxy?

Solution
    1. Open ZAP and go to Options > Local Proxies and set it to localhost:8081 (for example).
    2. Go to Firefox Connection Settings and set up the proxy for the same port:

    Firefox proxy settings

    1. Start Burp Community Edition and go to Proxy > Options tab and verify Burp is listening at localhost:8080

    Burp proxy settings

    1. Now go back to ZAP and in Options > Connection > Use Proxy Chain check Use an outgoing proxy server and fill in the Burp's port settings:

    ZAP Connection settings

    1. If you now visit the target page in Firefox, it will show up in both ZAP and Burp dashboards. But now you can use ZAP's crawling option by right clicking the site and selecting Attack > Spider and the resulting pages will show up in Burp as well.

    Credit: found it here.