Zed Attack Proxy (ZAP) step configuration

Scan application instances with ​Zed Attack Proxy (ZAP).

You can scan your application instances and ingest results from Zed Attack Proxy (ZAP).

For an example workflow, go to the DAST app scans using Zed Attack Proxy (ZAP) tutorial.

Important notes for running ZAP scans in STO

• Harness STO currently supports the following ZAP features:

  • AJAX spidering with Firefox and Selenium. Other browsers such as Chrome are not currently supported.

  • Script-based authentication.

  • Form-based authentication.

  • Script-based session management – ECMAScript / JavaScript using Nashorn engine.

    • Other languages such as Zest, Groovy, Python, etc. are not currently supported.

• ZAP is a highly configurable tool with many options. You should verify that your context file and your authentication and other scripts work as intended before adding them to your STO pipeline.

• Add the following shared paths (Overview > Shared Paths) to your scan stage and copy your ZAP scripts and files to these paths:

  • Copy hosts and urlFile files to:

    • /shared/customer_artifacts/hosts/

    • /shared/customer_artifacts/urlFile/

  • Copy context files to /shared/customer_artifacts/context.

  • You also need to specify the Context name to use for the scan.

    • If you're including context, hosts, and/or urlFile files in the same pipeline, they all need to be set to the value passed for the context name. For example:

      • /shared/customer_artifacts/context/sto.context

      • /shared/customer_artifacts/hosts/sto.context

      • /shared/customer_artifacts/urlFile/sto.context

  • Copy other scripts to /shared/customer_artifacts/scripts/<script-type>/.

    • Examples:

      • /shared/customer_artifacts/scripts/session

      • /shared/customer_artifacts/scripts/authentication

    • For other script paths, go to the ZAP community-scripts repo.

Root access requirements

For more information

ZAP step settings for STO scans

The recommended workflow is to add a ZAP step to a Security Tests or CI Build stage and then configure it as described below.

Scan

Scan Mode

Scan Configuration

The following options are supported for Zap scans:

• Default

• Standard scanMode = active, scanType = standard

• Attack scanMode = active, scanType = attack

• Quick scanMode = active, scanType = standard, quickMode = true

  When Quick mode is enabled, the Maximum depth to crawl is set to 1.

Target

Type

Target and variant detection

Name

Variant

Workspace

Instance

Domain

Protocol

Port

Path

Scan Tool

Context Name

The ZAP context file to use for the scan. You need to add the following shared path (Overview > Shared Paths) to the stage and copy your file to this path: - /shared/customer_artifacts/context/

Port

Ingestion File

Log Level

Fail on Severity

Settings

Additional Configuration

Advanced settings

Configure ZAP as a Built-in Scanner

The ZAP scanner is available as a built-in scanner in STO. Configuring it as a built-in scanner enables the step to automatically perform scans using the free version without requiring any licenses. Follow these steps to set it up:

1. Search for DAST in the step palette or navigate to the Built-in Scanners section and select the DAST step.

2. Select Aqua Trivy from the list of scanners.

3. Expand the Additional CLI Flags section if you want to configure optional CLI flags.

4. Configure the Domain Information by setting the Domain.

5. Click Add Scanner to save the configuration.

The scanner will automatically use the free version, detect scan targets, and can be further configured by clicking on the step whenever needed.