Scan Types
- Passive ScanNon-intrusive
- Active ScanAttack simulation
- SpiderCrawl site
- Ajax SpiderJS crawling
- Baseline ScanQuick check
- Full ScanComplete test
Alert Risk Levels
- HighCritical issues
- MediumSignificant risk
- LowMinor issues
- InformationalNo direct risk
- False PositiveNot real issue
Common Attacks
- SQL InjectionDatabase attacks
- XSSScript injection
- CSRFRequest forgery
- Path TraversalFile access
- Command InjectionOS commands
Spider Options
- Max DepthCrawl depth
- Max ChildrenLinks per page
- Domains in ScopeTarget domains
- Parse FormsSubmit forms
Docker Scans
# Baseline scan (passive only)
docker run -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \
-t https://example.com
# Full scan (spider + active scan)
docker run -t ghcr.io/zaproxy/zaproxy:stable zap-full-scan.py \
-t https://example.com
# API scan with OpenAPI spec
docker run -t ghcr.io/zaproxy/zaproxy:stable zap-api-scan.py \
-t https://example.com/openapi.json \
-f openapi
# Save report
docker run -v $(pwd):/zap/wrk -t ghcr.io/zaproxy/zaproxy:stable \
zap-baseline.py -t https://example.com -r report.html
API Automation
# Start ZAP daemon
zap.sh -daemon -port 8080 -host 0.0.0.0 -config api.key=myapikey
# Python API usage
from zapv2 import ZAPv2
zap = ZAPv2(apikey='myapikey', proxies={'http': 'http://localhost:8080'})
# Spider a target
zap.spider.scan(url='https://example.com')
# Active scan
zap.ascan.scan(url='https://example.com')
# Get alerts
alerts = zap.core.alerts()
CLI Options
- -tTarget URL
- -rReport file
- -JJSON report
- -wMD report
- -cConfig file
- -zZAP options
Authentication
- Form-basedLogin forms
- HTTP BasicBasic auth
- JSON-basedAPI auth
- Script-basedCustom auth
- ManualSession tokens
GitHub Actions Integration
name: OWASP ZAP Scan
on: [push]
jobs:
zap_scan:
runs-on: ubuntu-latest
steps:
- name: ZAP Baseline Scan
uses: zaproxy/action-baseline@v0.10.0
with:
target: 'https://example.com'
rules_file_name: '.zap/rules.tsv'
cmd_options: '-a'
- name: Upload Report
uses: actions/upload-artifact@v3
with:
name: zap-report
path: report_html.html
Contexts
- Include URLsScope targets
- Exclude URLsSkip URLs
- UsersTest users
- TechTechnologies
Report Formats
- HTMLWeb report
- XMLXML format
- JSONJSON format
- MarkdownMD format
- SARIFGitHub format