config.xml

<?xml version="1.0" encoding="ISO-8859-1" ?>
<web-app>
    <!-- The settings in this file are for the demo ropey-tasks vulnerable web app available at: https://github.com/stephendv/RopeyTasks,
            which is included in the bdd-security framework for demo purposes.

         You'll need to modify this file for your app -->

    <!-- The default driver for tests that don't require a proxy.
         Some drivers require a path to the platform specific driver binary, for example chrome needs chromedriver
    <defaultDriver>firefox</defaultDriver> -->
    <defaultDriver path="drivers/chromedriver-mac">Chrome</defaultDriver>

    <!-- The driver configured to use ZAP as the proxy -->
    <proxyDriver path="drivers/chromedriver-mac">Chrome</proxyDriver>

    <!-- Base URL for the application to test -->
    <baseUrl>http://localhost:9090/</baseUrl>

    <!-- Used for the SSL and the HTTP header tests -->
    <baseSecureUrl>https://www.wormly.com/</baseSecureUrl>

    <!-- The fully qualified class name representing the application under test -->
    <class>net.continuumsecurity.examples.ropeytasks.RopeyTasksApplication</class>

    <sslyze>/opt/sslyze/sslyze.py</sslyze>

    <!-- Names of the session ID cookies -->
    <sessionIds>
        <name>JSESSIONID</name>
    </sessionIds>

    <users>
        <user username="alice" password="password"/>
        <user username="bob" password="password"/>
        <user username="admin" password="password"/>
    </users>

    <incorrectPassword>SDFsdfwjx1</incorrectPassword>
    <incorrectUsername>bobbles</incorrectUsername>

    <nessus>
        <username>continuum</username>
        <password>continuum</password>
    </nessus>

    <proxy>
        <host>127.0.0.1</host>
        <port>8888</port>
        <api></api>
    </proxy>

    <displayStackTrace>true</displayStackTrace>
    <storyDir>src/main/stories/</storyDir>
    <reportsDir>reports</reportsDir>
    <latestReportsDir>reports/latest</latestReportsDir>
    <storyTimeout>3600</storyTimeout> <!-- for a single story in seconds -->
</web-app>