ZAP Docker Documentation on ZAP

Diagnosing Docker Problems

Mon, 01 Jan 0001 00:00:00 +0000

Docker is a great way to run ZAP in a CI/CD pipeline, but diagnosing problems can be tricky.

ZAP Cannot Connect to the Target

If ZAP cannot connect to your target app then the first thing to do is to see if this is a ‘Docker’ networking issue.

ZAP - API Scan

Mon, 01 Jan 0001 00:00:00 +0000

The ZAP API scan is a script that is available in the ZAP Docker images.

It is tuned for performing scans against APIs defined by OpenAPI, SOAP, or GraphQL via either a local file or a URL.

It imports the definition that you specify and then runs an Active Scan against the URLs found. The Active Scan is tuned to APIs, so it doesn’t bother looking for things like XSSs.

ZAP - Baseline Scan

Mon, 01 Jan 0001 00:00:00 +0000

The ZAP Baseline scan is a script that is available in the ZAP Docker images.

It runs the ZAP spider against the specified target for (by default) 1 minute and then waits for the passive scanning to complete before reporting the results.

This means that the script doesn’t perform any actual ‘attacks’ and will run for a relatively short period of time (a few minutes at most).

ZAP - Full Scan

Mon, 01 Jan 0001 00:00:00 +0000

The ZAP full scan is a script that is available in the ZAP Docker images.

It runs the ZAP spider against the specified target (by default with no time limit) followed by an optional ajax spider scan and then a full active scan before reporting the results.

This means that the script does perform actual ‘attacks’ and can potentially run for a long period of time.

ZAP - Scan Hooks

Mon, 01 Jan 0001 00:00:00 +0000

Scan Hooks

To make it easy to make little tweaks here and there a hook system is in place to help you. It enables you to override or modify behaviour of the script components instead of having to write a new script.

Use Cases

Modifying Args
For the AJAX crawler you may want to target a suburl with a specific hash (http://example.com vs http://example.com/#/dashboard). You can use the zap_ajax_spider hook to intercept the arguments and modify them.

ZAP - Webswing Usage

Mon, 01 Jan 0001 00:00:00 +0000

Starting with version 2.5.0 you can run the ZAP Desktop UI in your browser without having to install Java, thanks to the magic of Docker and Webswing

To do this you will just need Docker installed. Start the container with webswing support:

Stable:
- docker run -u zap -p 8080:8080 -p 8090:8090 -i ghcr.io/zaproxy/zaproxy:stable zap-webswing.sh
Weekly:
- docker run -u zap -p 8080:8080 -p 8090:8090 -i ghcr.io/zaproxy/zaproxy:weekly zap-webswing.sh

Then point your browser at:

ZAP Docker User Guide

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

Docker image with Zed Attack Proxy preinstalled.

Please note that ZAP Docker images are available on Docker Hub as well as GitHub Container Registry (GHCR). While the docker run commands on this page use the Docker Hub images, either can be used interchangeably.

Details

Install Instructions

Stable

The stable image is updated whenever there is a ZAP full release. It is also regenerated monthly, typically on the first Monday of the month. The monthly updates pull in the latest base Docker image and also any updated ZAP add-ons - no ZAP ‘core’ changes are included.