config.xml

<?xml version="1.0" encoding="ISO-8859-1" ?>
<web-app>

    <!-- Base URL of the application to test -->
    <baseUrl>http://10.1.1.251:8080/WebGoat/</baseUrl>

    <!-- A Java class to hold the Selenium steps to test the application in depth. Optionally required for in-depth authn/z and session management testing. -->
    <class>net.continuumsecurity.WebGoatApplication</class>

    <sslyze>
        <path>/opt/sslyze/sslyze_cli.py</path>
        <option>--regular</option>
    </sslyze>

    <!-- Optional names of the session ID cookies for session management testing. -->
    <sessionIds>
        <name>JSESSIONID</name>
    </sessionIds>

    <!-- the default user to use when logging in to the app -->
    <defaultUsername>guest</defaultUsername>
    <defaultPassword>guest</defaultPassword>

    <scanner>
        <ignoreUrl>.*logout.*</ignoreUrl>
        <spiderUrl>baseUrl</spiderUrl>
    </scanner>
    <upstreamProxy>
        <host></host>
        <port></port>
    </upstreamProxy>

    <incorrectPassword>SDFsdfwjx1</incorrectPassword>
    <incorrectUsername>bobbles</incorrectUsername>

    <nessus>
        <username>continuum</username>
        <password>continuum</password>
    </nessus>
    <zapPath>zap/zap.sh</zapPath>

</web-app>