oam/knowledge base/owasp zap.md

Zed Attack Proxy

Widely used free and open source web app scanner.

Helps automatically find security vulnerabilities in web applications.

1. TL;DR
2. Further readings
   1. Sources

TL;DR

Setup

docker pull 'zaproxy/zap-stable'  # or 'ghcr.io/zaproxy/zaproxy:stable'

Usage

# Get a shell in the container.
docker run --rm --name 'zap' -ti 'zaproxy/zap-stable'

# Start the Web UI.
docker run --rm --name 'web-ui' -d -u 'zap' -p '8080:8080' -p '8090:8090' 'zaproxy/zap-stable' zap-webswing.sh \
&& open 'http://localhost:8080/zap/'

# Start API scans.
docker run --rm --name 'api-scan' 'zaproxy/zap-stable' zap-api-scan.py -t 'http://localhost:3000/api/v1/' -f 'openapi'

Further readings

• Website
• Codebase

Sources

• Documentation