> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/zap/zap-scanner-reference.md).

# Zed Attack Proxy (ZAP) step configuration

You can scan your application instances and ingest results from [Zed Attack Proxy (ZAP)](https://www.zaproxy.org).

For an example workflow, go to the [DAST app scans using Zed Attack Proxy (ZAP) tutorial](/security-testing-orchestration/use-sto/sto-scanner-configuration/zap/dast-scan-zap.md).

### Important notes for running ZAP scans in STO <a href="#important-notes-for-running-zap-scans-in-sto" id="important-notes-for-running-zap-scans-in-sto"></a>

* Harness STO currently supports the following ZAP features:
  * AJAX spidering with Firefox and Selenium. Other browsers such as Chrome are not currently supported.
  * [Script-based authentication](https://www.zaproxy.org/docs/desktop/start/features/authmethods/#scriptBased).
  * [Form-based authentication](https://www.zaproxy.org/docs/desktop/start/features/authmethods/#formBased).
  * [Script-based session management](https://www.zaproxy.org/docs/desktop/start/features/sessionmanagement/#sbsm) – ECMAScript / JavaScript using Nashorn engine.
    * Other languages such as Zest, Groovy, Python, etc. are not currently supported.
* ZAP is a highly configurable tool with many options. You should verify that your context file and your authentication and other scripts work as intended before adding them to your STO pipeline.
* Add the following shared paths (**Overview** > **Shared Paths**) to your scan stage and copy your ZAP scripts and files to these paths:
  * Copy hosts and urlFile files to:
    * `/shared/customer_artifacts/hosts/`
    * `/shared/customer_artifacts/urlFile/`
  * Copy context files to `/shared/customer_artifacts/context`.
  * You also need to specify the [Context name](#context-name) to use for the scan.
    * If you're including context, hosts, and/or urlFile files in the same pipeline, they all need to be set to the value passed for the context name. For example:
      * `/shared/customer_artifacts/context/sto.context`
      * `/shared/customer_artifacts/hosts/sto.context`
      * `/shared/customer_artifacts/urlFile/sto.context`
  * Copy other scripts to `/shared/customer_artifacts/scripts/<script-type>/`.
    * Examples:
      * `/shared/customer_artifacts/scripts/session`
      * `/shared/customer_artifacts/scripts/authentication`
    * For other script paths, go to the [ZAP community-scripts repo](https://github.com/zaproxy/community-scripts/tree/main).

#### Root access requirements <a href="#root-access-requirements" id="root-access-requirements"></a>

#### For more information <a href="#for-more-information" id="for-more-information"></a>

### ZAP step settings for STO scans <a href="#zap-step-settings-for-sto-scans" id="zap-step-settings-for-sto-scans"></a>

The recommended workflow is to add a ZAP step to a Security Tests or CI Build stage and then configure it as described below.

#### Scan <a href="#scan" id="scan"></a>

**Scan Mode**

**Scan Configuration**

The following options are supported for Zap scans:

* **Default**
* **Standard** `scanMode` = [`active`](https://www.zaproxy.org/docs/desktop/start/features/ascan/), `scanType` = [`standard`](https://www.zaproxy.org/docs/desktop/start/features/modes/)
* **Attack** `scanMode` = [`active`](https://www.zaproxy.org/docs/desktop/start/features/ascan/), `scanType` = [`attack`](https://www.zaproxy.org/docs/desktop/start/features/modes/)
* **Quick** `scanMode` = [`active`](https://www.zaproxy.org/docs/desktop/start/features/ascan/), `scanType` = [`standard`](https://www.zaproxy.org/docs/desktop/start/features/modes/), `quickMode` = `true`

  When Quick mode is enabled, the [Maximum depth to crawl](https://www.zaproxy.org/docs/desktop/addons/spider/options/#maximum-depth-to-crawl) is set to 1.

#### Target <a href="#target" id="target"></a>

**Type**

**Target and variant detection**

**Name**

**Variant**

**Workspace**

#### Instance <a href="#instance" id="instance"></a>

**Domain**

**Protocol**

**Port**

**Path**

#### Scan Tool <a href="#scan-tool" id="scan-tool"></a>

**Context Name**

The ZAP context file to use for the scan. You need to add the following shared path (**Overview** > **Shared Paths**) to the stage and copy your file to this path: - `/shared/customer_artifacts/context/`

**Port**

#### Ingestion File <a href="#ingestion-file" id="ingestion-file"></a>

#### Log Level <a href="#log-level" id="log-level"></a>

#### Fail on Severity <a href="#fail-on-severity" id="fail-on-severity"></a>

#### Settings <a href="#settings" id="settings"></a>

#### Additional Configuration <a href="#additional-configuration" id="additional-configuration"></a>

#### Advanced settings <a href="#advanced-settings" id="advanced-settings"></a>

### Configure ZAP as a Built-in Scanner <a href="#configure-zap-as-a-built-in-scanner" id="configure-zap-as-a-built-in-scanner"></a>

The ZAP scanner is available as a built-in scanner in STO. Configuring it as a built-in scanner enables the step to automatically perform scans using the free version without requiring any licenses. Follow these steps to set it up:

1. Search for **DAST** in the step palette or navigate to the **Built-in Scanners** section and select the **DAST** step.
2. Select **Aqua Trivy** from the list of scanners.
3. Expand the **Additional CLI Flags** section if you want to configure optional CLI flags.
4. Configure the **Domain Information** by setting the [Domain](#domain).
5. Click **Add Scanner** to save the configuration.

The scanner will automatically use the free version, detect scan targets, and can be further configured by clicking on the step whenever needed.