Structural parameters are a type of Structural Modifier which identify parameters that represent application structure instead of user data.
In ’traditional’ web applications the structure of the application is typically defined by the URL paths
and the data is contained in the URL parameters and POST data.
are represented in the Sites Tree as one ’node’ in the tree:
The Sites tree is very important as it reflects ZAP’s understanding of the application structure.
If it is not a good representation of the structure then ZAP will not be able to attack the application effectively.
In ‘single’ page applications a parameter is used to indicate the logical ‘page’:
these 3 URLs represent different logical pages, but by default ZAP will still represent them as one node:
This is a problem because ZAP will now not attack all of the application’s functionality.
In ZAP terms the ‘page’ URL parameter is a ‘structural parameter’ - a parameter that defines part of the application structure.
You can define structural parameters by adding the application to a Context and then configuring them via the Session Context Structure screen.
Once you have done this the pages will be correctly represented as 3 nodes:
|Session Context Structure screen|
|UI Overview||for an overview of the user interface|
|Features||provided by ZAP|
|Structural Modifiers||controls which change how ZAP represents the structure of the application|
|Data Driven Content||which identify URL paths that represent data|