zap

What it does

How to write it

docker run -t zaproxy/zap-stable zap-baseline.py -t URL [OPTIONS]
zap-full-scan.py | zap-api-scan.py -t URL ...

Main parts

Scan scripts

zap-baseline.py

Spider + passive scan; safe for production.

zap-full-scan.py

Spider + active attacks; test systems only.

zap-api-scan.py -f openapi|graphql|soap

Scan an API from its definition.

zap.sh -daemon

Run ZAP headless with its API.

Most used

Nothing matches this filter.

$ run as a normal user# run as root (or with sudo)

1. 1Baseline scan of a test site

   $docker run --rm -v "$PWD:/zap/wrk:rw" -t zaproxy/zap-stable zap-baseline.py -t https://staging.example.com -r baseline.html

2. 2Read the summary

   $docker run --rm -t zaproxy/zap-stable zap-baseline.py -t https://staging.example.com | tail -5
   FAIL-NEW: 0  FAIL-INPROG: 0  WARN-NEW: 6  WARN-INPROG: 0  INFO: 0  IGNORE: 0  PASS: 58

3. 3Make your own rule config

   $docker run --rm -v "$PWD:/zap/wrk:rw" -t zaproxy/zap-stable zap-baseline.py -t https://staging.example.com -g zap-rules.tsv
   $grep 10038 zap-rules.tsv
   10038	FAIL	(Content Security Policy (CSP) Header Not Set)

4. 4Use the rules in CI

   $docker run --rm -v "$PWD:/zap/wrk:rw" -t zaproxy/zap-stable zap-baseline.py -t https://staging.example.com -c zap-rules.tsv -J zap.json

5. 5Scan an API from OpenAPI

   $docker run --rm -v "$PWD:/zap/wrk:rw" -t zaproxy/zap-stable zap-api-scan.py -t https://staging.example.com/openapi.json -f openapi -r api.html

6. 6Full active scan of a test environment

   $docker run --rm -v "$PWD:/zap/wrk:rw" -t zaproxy/zap-stable zap-full-scan.py -t https://test.lab.local -m 10 -r full.html

7. 7Scan with a login token

   $docker run --rm -t zaproxy/zap-stable zap-api-scan.py -t https://staging.example.com/openapi.json -f openapi -z "-config replacer.full_list(0).matchtype=REQ_HEADER -config replacer.full_list(0).matchstr=Authorization -config replacer.full_list(0).replacement='Bearer TEST_TOKEN'"

8. 8GitHub Actions

   $cat .github/workflows/dast.yml
         - uses: zaproxy/action-baseline@v0.14.0
           with: { target: "https://staging.example.com", rules_file_name: "zap-rules.tsv" }

9. 9Count findings by risk from JSON

   $jq -r '.site[].alerts[] | .riskdesc' zap.json | cut -d' ' -f1 | sort | uniq -c

10. 10Check the headers ZAP complains about

    $curl -sI https://staging.example.com | grep -iE "content-security-policy|strict-transport|x-content-type"

Nothing matches this filter.

Files

/zap/wrk

Mounted folder for reports and configs (Docker).

zap-rules.tsv

Rule config (ID, action, name).

Exit codes