A ZAP CSTI active scan rule

Tue, 09 Jun 2026 00:00:00 +0000

Introduction

I started to work on this project as an intern at Djezzy Optimum Télécom Algérie SPA, under the supervision of Mr. Beraoud Abdelkhalek who was behind the idea and whose invaluable guidance, transformative advice, and remarkable patience supported the work throughout its development.

The active scan rule described here was built as an alpha rule for ZAP. You can find the code here.

Implementation Basis: The CSTI-Alert Paper

The methodology comes from the paper: {{alert('CSTI')}}: Large-Scale Detection of Client-Side Template Injection. The part we are concerned with for this active scan rule is not the large-scale crawling infrastructure itself, but the detection methodology:

Tools on Nabil Kara — CTF Writeups

A ZAP CSTI active scan rule

Introduction

Implementation Basis: The CSTI-Alert Paper