This add-on adds a Client Spider which is designed to explore modern web apps more effectively.
The Client Spider is now the recommended option for automatically crawling modern web apps, as it out performs the older AJAX spider in all known cases.
The Client Spider works in a similar way to the AJAX Spider but it has access to the DOM via the ZAP Browser Extension which means that it can find content which the AJAX Spider cannot find.
The Client Spider supports all of the authentication options supported by ZAP, and will run any enabled Selenium scripts in the browsers that it launches.
The spider can be invoked via:
The default spider options can be set via the Spider Options panel.
The dialog for starting the Client Spider provides 2 sub tabs:
This tab allows you to define what the spider will attempt to explore.
The Scope Check controls how the spider handles out-of-scope resources — see the Spider Options for details.
This tab allows you to override the default options that control how the spider works. See the Spider Options for a description of each option.
The Client Spider tab allows you start and monitor the Client Spider. It provides 3 sub tabs:
These are the nodes that have been added to the Client Map.
These are the tasks that spider uses to crawl the application. The tasks are updated when they are added to the task list, when they start running, and when they complete. This allows you to understand what the Client Spider is actually doing much more clearly.
These are the HTTP(S) messages sent from the browsers that the client uses.