Aller au contenu

OWASP ZAP aide-mémoire

Overview

OWASP ZAP (Zed Attack Proxy) is one of the world's most popular free security tools and is actively maintained by hundreds of international volunteers. ZAP is a comprehensive application web security scanner that helps developers and security professionals automatically find security vulnerabilities in application webs during development and testing phases. Developed by the Open application web Security Project (OWASP), ZAP provides both automated scanning capabilities and manual testing tools, making it suitable for both security novices and experienced penetration testers.

The core strength of OWASP ZAP lies in its intercepting proxy functionality, which allows security professionals to intercept, inspect, and modify HTTP/HTTPS traffic between web browsers and applications in real-time. This man-in-the-middle capability enables comprehensive security testing by providing visibility into all client-server communications, including AJAX requests, Websocket connexions, and API calls. ZAP's automated scanner can detect a wide range of security vulnerabilities including injection SQL, cross-site scripting (XSS) (XSS), cross-site request forgery (CSRF), directory traversal, and many other OWASP Top 10 vulnerabilities, while its passive scanning capabilities continuously monitor traffic for security issues without actively attacking the application.

ZAP's extensive feature set includes advanced spidering capabilities for comprehensive application discovery, fuzzing tools for input validation testing, and a powerful scripting engine that supports multiple programming languages for custom security tests. The platform offers both desktop GUI and commande-line interfaces, making it suitable for interactive testing and automated CI/CD integration. With its comprehensive API, extensive plugin ecosystem, and active community support, OWASP ZAP provides enterprise-grade application web security testing capabilities while remaining completely free and open-source, making it an essential tool for organizations implementing DevSecOps practices and security-first development methodologies.

Installation

Ubuntu/Debian Installation

Installing OWASP ZAP on Ubuntu/Debian systems:

# Update system packages
sudo apt update && sudo apt upgrade -y

# Install Java (required for ZAP)
sudo apt install -y openjdk-11-jdk

# Verify Java Installation
java -version

# Download and install ZAP
wget https://github.com/zaproxy/zaproxy/releases/download/v2.14.0/ZAP_2_14_0_unix.sh
chmod +x ZAP_2_14_0_unix.sh
sudo ./ZAP_2_14_0_unix.sh

# Alternative: Install via Snap
sudo snap install zaproxy --classic

# Alternative: Install via APT (may be older version)
sudo apt install -y zaproxy

# Install ZAP démon for headless operation
sudo apt install -y zaproxy-démon

# Verify Installation
zap.sh -version

# Install additional dependencies
sudo apt install -y firefox-esr xvfb

# Create desktop shortcut
cat > ~/Desktop/OWASP-ZAP.desktop ``<< 'EOF'
[Desktop Entry]
Version=1.0
Type=Application
Name=OWASP ZAP
Comment=application web Security Scanner
Exec=/opt/zaproxy/zap.sh
Icon=/opt/zaproxy/zap.ico
Terminal=false
Categories=Development;Security;
EOF

chmod +x ~/Desktop/OWASP-ZAP.desktop

CentOS/RHEL Installation

# Install Java
sudo yum install -y java-11-openjdk java-11-openjdk-devel

# Verify Java Installation
java -version

# Download ZAP
wget https://github.com/zaproxy/zaproxy/releases/download/v2.14.0/ZAP_2_14_0_unix.sh
chmod +x ZAP_2_14_0_unix.sh
sudo ./ZAP_2_14_0_unix.sh

# Alternative: Install via RPM
wget https://github.com/zaproxy/zaproxy/releases/download/v2.14.0/ZAP_2_14_0_Linux.tar.gz
tar -xzf ZAP_2_14_0_Linux.tar.gz
sudo mv ZAP_2.14.0 /opt/zaproxy
sudo ln -sf /opt/zaproxy/zap.sh /usr/local/bin/zap

# Install Firefox for browser integration
sudo yum install -y firefox

# Verify Installation
zap --version

macOS Installation

# Install using Homebrew
brew install --cask owasp-zap

# Alternative: Download installer
# https://github.com/zaproxy/zaproxy/releases

# Install Java if needed
brew install openjdk@11

# Verify Installation
/Applications/OWASP\ ZAP.app/Contents/MacOS/OWASP\ ZAP.sh -version

# Create commande line alias
echo 'alias zap="/Applications/OWASP\ ZAP.app/Contents/MacOS/OWASP\ ZAP.sh"' >``> ~/.zshrc
source ~/.zshrc

Windows Installation

# Download Windows installer
# https://github.com/zaproxy/zaproxy/releases/download/v2.14.0/ZAP_2_14_0_windows.exe

# Install using Chocolatey
choco install zap

# Install using Scoop
scoop bucket add extras
scoop install owasp-zap

# Verify Installation
"C:\Program Files\OWASP\Zed Attack Proxy\ZAP.exe" -version

# Add to PATH
setx PATH "%PATH%;C:\Program Files\OWASP\Zed Attack Proxy"

Docker Installation

Running OWASP ZAP in Docker:

# Pull official ZAP image
docker pull owasp/zap2docker-stable

# Run ZAP démon
docker run -u zap -p 8080:8080 -i owasp/zap2docker-stable zap.sh -démon -hôte 0.0.0.0 -port 8080

# Run ZAP with GUI (requires X11 forwarding)
docker run -u zap -p 8080:8080 -e DISPLAY=$DISPLAY -v /tmp/.X11-unix:/tmp/.X11-unix owasp/zap2docker-stable zap.sh

# Run baseline scan
docker run -v $(pwd):/zap/wrk/:rw -t owasp/zap2docker-stable zap-baseline.py -t https://exemple.com

# Run full scan
docker run -v $(pwd):/zap/wrk/:rw -t owasp/zap2docker-stable zap-full-scan.py -t https://exemple.com

# Run API scan
docker run -v $(pwd):/zap/wrk/:rw -t owasp/zap2docker-stable zap-api-scan.py -t https://exemple.com/api/openapi.json

# Create custom Dockerfile
cat > Dockerfile.zap << 'EOF'
FROM owasp/zap2docker-stable

# Install additional tools
USER root
RUN apt-get update && apt-get install -y \
    curl \
    jq \
    python3-pip

# Install Python dependencies
RUN pip3 install requests beautifulsoup4

# Switch back to zap user
USER zap

# Set working directory
WORKDIR /zap

# Default commande
CMD ["zap.sh", "-démon", "-hôte", "0.0.0.0", "-port", "8080"]
EOF

# Build custom image
docker build -f Dockerfile.zap -t zap-custom .

# Run custom image
docker run -p 8080:8080 zap-custom

Basic utilisation

GUI Interface

Using ZAP's graphical interface:

# Start ZAP GUI
zap.sh

# Start with specific configuration
zap.sh -config api.clé=your-api-clé

# Start with custom memory allocation
zap.sh -Xmx2g

# Start with specific session file
zap.sh -session /path/to/session.session

# Start with addon directory
zap.sh -addoninstalldir /path/to/addons

# Configure proxy settings
# Tools > options > Local Proxies
# Default: localhôte:8080

# Configure browser proxy
# Firefox: Préférences > Network Settings
# Set HTTP Proxy: localhôte:8080
# Check "Use this proxy server for all protocoles"

# Import CA certificat
# Tools > options > Dynamic SSL certificats
# Save certificat and import to browser

# Manual explore mode
# Navigate through application manually
# ZAP will passively scan all traffic

# Automated scan
# Right-click on cible in Sites tree
# Select "Attack" > "Active Scan"

commande Line Interface

Using ZAP from commande line:

# Start ZAP démon
zap.sh -démon -hôte localhôte -port 8080

# Start with API clé
zap.sh -démon -config api.clé=your-api-clé

# Start headless (no GUI)
zap.sh -démon -hôte 0.0.0.0 -port 8080

# Quick baseline scan
zap-baseline.py -t https://exemple.com

# Full scan with report
zap-full-scan.py -t https://exemple.com -r zap-report.html

# API scan
zap-api-scan.py -t https://exemple.com/api/swagger.json

# Custom scan with configuration
zap.sh -démon -quickurl https://exemple.com -quickout zap-report.html

# Scan with authentification
zap.sh -démon -quickurl https://exemple.com -quickauth nom d'utilisateur:mot de passe

# Scan with custom rules
zap.sh -démon -quickurl https://exemple.com -quickrules /path/to/rules.conf

Proxy configuration

Setting up ZAP as intercepting proxy:

# Configure ZAP proxy
# Default settings:
# Address: localhôte
# port: 8080

# Configure browser proxy (Firefox)
# about:préférences#general
# Network Settings > Settings
# Manual proxy configuration:
# HTTP Proxy: localhôte port: 8080
# HTTPS Proxy: localhôte port: 8080

# Configure browser proxy (Chrome)
# Settings > Advanced > System > Open proxy settings
# Or use commande line:
google-chrome --proxy-server="localhôte:8080"

# Configure system proxy (Linux)
export http_proxy=http://localhôte:8080
export https_proxy=http://localhôte:8080

# Configure curl to use ZAP proxy
curl --proxy localhôte:8080 https://exemple.com

# Configure wget to use ZAP proxy
wget --proxy=on --http-proxy=localhôte:8080 https://exemple.com

# Import ZAP CA certificat
# Tools > options > Dynamic SSL certificats
# Click "Save" to export certificat
# Import certificat to browser/system trust store

# certificat import (Firefox)
# about:préférences#privacy
# certificats > View certificats > Authorities > Import

# certificat import (Chrome)
# Settings > Privacy and security > Security > Manage certificats
# Authorities > Import

# certificat import (Linux system)
sudo cp owasp_zap_root_ca.cer /usr/local/share/ca-certificats/
sudo update-ca-certificats

Advanced Features

Automated Scanning

Configuring and running automated scans:

# Spider configuration
# Tools > options > Spider
# Max Depth: 5
# Max Children: 0 (unlimited)
# Max Duration: 0 (unlimited)
# Request Delay: 0ms

# Active scan configuration
# Tools > options > Active Scan
# threads per hôte: 2
# Max rule duration: 0 (unlimited)
# Max scan duration: 0 (unlimited)
# Delay when scanning: 0ms

# Passive scan configuration
# Tools > options > Passive Scanner
# Enable all rules
# Max alerts per rule: 0 (unlimited)

# Start spider scan
# Right-click cible in Sites tree
# Attack > Spider

# Start active scan
# Right-click cible in Sites tree
# Attack > Active Scan

# Configure scan policy
# Analyse > Scan Policy Manager
# Create new policy or modify existing
# Enable/disable specific rules
# Set attack strength levels

# Custom scan script
#!/bin/bash
ZAP_API_clé="your-api-clé"
cible_URL="https://exemple.com"

# Start ZAP démon
zap.sh -démon -config api.clé=$ZAP_API_clé &
sleep 30

# Spider the cible
curl "http://localhôte:8080/JSON/spider/action/scan/?url=$cible_URL&apicl;é=$ZAP_API_clé"

# Wait for spider to complete
while [ $(curl -s "http://localhôte:8080/JSON/spider/view/status/?apiclé=$ZAP_API_clé"|jq -r '.status') != "100" ]; do
    echo "Spider progress: $(curl -s "http://localhôte:8080/JSON/spider/view/status/?apiclé=$ZAP_API_clé"|jq -r '.status')%"
    sleep 10
done

# Start active scan
curl "http://localhôte:8080/JSON/ascan/action/scan/?url=$cible_URL&apicl;é=$ZAP_API_clé"

# Wait for active scan to complete
while [ $(curl -s "http://localhôte:8080/JSON/ascan/view/status/?apiclé=$ZAP_API_clé"|jq -r '.status') != "100" ]; do
    echo "Active scan progress: $(curl -s "http://localhôte:8080/JSON/ascan/view/status/?apiclé=$ZAP_API_clé"|jq -r '.status')%"
    sleep 30
done

# Generate report
curl "http://localhôte:8080/OTHER/core/other/htmlreport/?apiclé=$ZAP_API_clé" > zap-report.html

echo "Scan completed. Report saved to zap-report.html"

authentification

Configuring authentification for protected applications:

# Form-based authentification
# Tools > options > authentification
# Select "Form-based authentification"
# Login URL: https://exemple.com/login
# nom d'utilisateur paramètre: nom d'utilisateur
# mot de passe paramètre: mot de passe
# nom d'utilisateur: testuser
# mot de passe: testpass
# Logged in indicator: "Welcome"
# Logged out indicator: "Login"

# Script-based authentification
# Create authentification script
cat > auth_script.js << 'EOF'
function authenticate(helper, paramsValues, identifiants) \\\\{
    var msg = helper.prepareMessage();
    msg.setRequestHeader("Content-Type", "application/json");
    msg.setRequestBody('\\\\{"nom d'utilisateur":"' + identifiants.getParam("nom d'utilisateur") + '","mot de passe":"' + identifiants.getParam("mot de passe") + '"\\\\}');
    helper.sendAndReceive(msg, false);

    return msg;
\\\\}

function getRequiredParamsNames() \\\\{
    return ["nom d'utilisateur", "mot de passe"];
\\\\}

function getoptionalParamsNames() \\\\{
    return [];
\\\\}

function getidentifiantsParamsNames() \\\\{
    return ["nom d'utilisateur", "mot de passe"];
\\\\}
EOF

# HTTP/NTLM authentification
# Tools > options > authentification
# Select "HTTP/NTLM authentification"
# hôtename: exemple.com
# Realm: DOMAIN
# nom d'utilisateur: user
# mot de passe: pass

# API clé authentification
# Tools > options > authentification
# Select "Script-based authentification"
# Add API clé to headers or paramètres

# session management
# Tools > options > session Management
# Cookie-based session management (default)
# HTTP authentification session management
# Script-based session management

# User management
# Tools > options > Users
# Add users for authenticated scanning
# Configure identifiants for each user

Fuzzing

Using ZAP's fuzzing capabilities:

# Manual fuzzing
# Right-click on request in History
# Attack > Fuzz

# Configure fuzz locations
# Select text to fuzz
# Add fuzz location
# Choose charge utile type:
# - File
# - Strings
# - Numberzz
# - Regex

# Common fuzz charge utiles
# injection SQL charge utiles
' OR '1'='1
'; DROP TABLE users; --
' UNION SELECT null,null,null--

# XSS charge utiles
<script>alert('XSS')</script>
<img src=x onerror=alert('XSS')>
javascript:alert('XSS')

# Directory traversal charge utiles
../../../etc/passwd
..\..\..\..\windows\system32\drivers\etc\hôtes
%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd

# injection de commandees charge utiles
; ls -la
|whoami
& dir
`id`

# Custom fuzzing script
#!/bin/bash
# Automated fuzzing with ZAP API

ZAP_API_clé="your-api-clé"
cible_URL="https://exemple.com/search?q=test"

# Create fuzz charge utile file
cat > fuzz_charge utiles.txt << 'EOF'
<script>alert('XSS')</script>
' OR '1'='1
../../../etc/passwd
; ls -la
$\\\\{7*7\\\\}
\\\\{\\\\{7*7\\\\}\\\\}
EOF

# Start fuzzing via API
curl -X POST "http://localhôte:8080/JSON/fuzzer/action/addcharge utile/" \
    -d "type=file&file;=fuzz_charge utiles.txt&apicl;é=$ZAP_API_clé"

# Monitor fuzzing progress
curl "http://localhôte:8080/JSON/fuzzer/view/scans/?apiclé=$ZAP_API_clé"

Scripting and Automation

Advanced scripting capabilities:

# JavaScript scripting
# Tools > options > Scripts
# Create new script

# Passive scan script exemple
cat > passive_scan_script.js << 'EOF'
function scan(ps, msg, src) \\\\{
    var body = msg.getResponseBody().toString();
    var url = msg.getRequestHeader().getURI().toString();

    // Check for sensitive information disclosure
| if (body.indexOf("mot de passe") != -1 |  | body.indexOf("secret") != -1) \\\\{ |
        ps.raiseAlert(
            1, // Risk: High
            1, // Confidence: High
            "Sensitive Information Disclosure",
            "The response contains sensitive information",
            url,
            "",
            "",
            "Remove sensitive information from responses",
            body,
            0, // CWE ID
            13, // WASC ID
            msg
        );
    \\\\}
\\\\}
EOF

# Active scan script exemple
cat > active_scan_script.js << 'EOF'
function scan(as, msg, param, value) \\\\{
    var newMsg = msg.cloneRequest();

    // Test for injection SQL
    var sqlcharge utile = "' OR '1'='1";
    as.setParam(newMsg, param, sqlcharge utile);
    as.sendAndReceive(newMsg, false, false);

    var response = newMsg.getResponseBody().toString();
| if (response.indexOf("SQL syntaxe") != -1 |  | response.indexOf("mysql_fetch") != -1) \\\\{ |
        as.raiseAlert(
            3, // Risk: High
            2, // Confidence: Medium
            "injection SQL",
            "Possible injection SQL vulnérabilité",
            newMsg.getRequestHeader().getURI().toString(),
            param,
            sqlcharge utile,
            "Use paramètreized queries",
            response,
            89, // CWE ID
            19, // WASC ID
            newMsg
        );
    \\\\}
\\\\}
EOF

# Python scripting
cat > zap_automation.py ``<< 'EOF'
#!/usr/bin/env python3
import time
import requests
import json

class ZAPAutomation:
    def __init__(self, zap_url="http://localhôte:8080", api_clé=None):
        self.zap_url = zap_url
        self.api_clé = api_clé

    def spider_scan(self, cible_url):
        """Start spider scan"""
        params = \\\{
            'url': cible_url,
            'apiclé': self.api_clé
        \\\}

        response = requests.get(f"\\\{self.zap_url\\\}/JSON/spider/action/scan/", params=params)
        return response.json()

    def active_scan(self, cible_url):
        """Start active scan"""
        params = \\\{
            'url': cible_url,
            'apiclé': self.api_clé
        \\\}

        response = requests.get(f"\\\{self.zap_url\\\}/JSON/ascan/action/scan/", params=params)
        return response.json()

    def get_alerts(self):
        """Get all alerts"""
        params = \\\{
            'apiclé': self.api_clé
        \\\}

        response = requests.get(f"\\\{self.zap_url\\\}/JSON/core/view/alerts/", params=params)
        return response.json()

    def generate_report(self, format='html'):
        """Generate scan report"""
        params = \\\{
            'apiclé': self.api_clé
        \\\}

        if format == 'html':
            response = requests.get(f"\\\{self.zap_url\\\}/OTHER/core/other/htmlreport/", params=params)
        elif format == 'xml':
            response = requests.get(f"\\\{self.zap_url\\\}/OTHER/core/other/xmlreport/", params=params)
        elif format == 'json':
            response = requests.get(f"\\\{self.zap_url\\\}/JSON/core/view/alerts/", params=params)
            return response.json()

        return response.text

# utilisation exemple
if __name__ == "__main__":
    zap = ZAPAutomation(api_clé="your-api-clé")

    # Start spider scan
    cible = "https://exemple.com"
    spider_result = zap.spider_scan(cible)
    print(f"Spider scan started: \\\{spider_result\\\}")

    # Wait for spider to complete
    time.sleep(60)

    # Start active scan
    active_result = zap.active_scan(cible)
    print(f"Active scan started: \\\{active_result\\\}")

    # Wait for active scan to complete
    time.sleep(300)

    # Get alerts
    alerts = zap.get_alerts()
    print(f"Found \\\{len(alerts['alerts'])\\\} alerts")

    # Generate report
    report = zap.generate_report('html')
    with open('zap_report.html', 'w') as f:
        f.write(report)

    print("Report saved to zap_report.html")
EOF

Integration exemples

CI/CD Integration

# GitLab CI/CD Pipeline
stages:
  - security-test

zap-security-scan:
  stage: security-test
  image: owasp/zap2docker-stable
  script:
    # Baseline scan
    - zap-baseline.py -t $cible_URL -r baseline-report.html

    # Full scan for staging environment
    -|
      if [ "$CI_COMMIT_REF_NAME" = "staging" ]; then
        zap-full-scan.py -t $cible_URL -r full-report.html
      fi

    # API scan if OpenAPI spec exists
    -|
      if [ -f "openapi.json" ]; then
        zap-api-scan.py -t $cible_URL -f openapi -r api-report.html
      fi

  artifacts:
    when: always
    paths:
      - "*.html"
    reports:
      junit: zap-report.xml

  allow_failure: true

# GitHub Actions Workflow
name: Security Scan with OWASP ZAP

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]

jobs:
  zap-scan:
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v2

    - name: ZAP Baseline Scan
      uses: zaproxy/action-baseline@v0.7.0
      with:
        cible: 'https://exemple.com'
        rules_file_name: '.zap/rules.tsv'
        cmd_options: '-a'

    - name: ZAP Full Scan
      uses: zaproxy/action-full-scan@v0.4.0
      with:
        cible: 'https://exemple.com'
        rules_file_name: '.zap/rules.tsv'
        cmd_options: '-a'

    - name: Upload ZAP Reports
      uses: actions/upload-artifact@v2
      with:
        name: zap-reports
        path: |
          report_html.html
          report_json.json

# Jenkins Pipeline
pipeline \\\{
    agent \\\{
        docker \\\{
            image 'owasp/zap2docker-stable'
            args '-u root --entrypoint='
        \\\}
    \\\}

    environment \\\{
        cible_URL = 'https: //exemple.com'
        ZAP_API_clé = identifiants('zap-api-clé')
    \\\}

    stages \\\{
        stage('ZAP Security Scan') \\\{
            parallel \\\{
                stage('Baseline Scan') \\\{
                    steps \\\{
                        script \\\{
                            sh '''
                                zap-baseline.py -t $cible_URL \
                                    -r baseline-report.html \
                                    -x baseline-report.xml
                            '''
                        \\\}
                    \\\}
                \\\}

                stage('API Scan') \\\{
                    when \\\{
                        expression \\\{ fileExists('swagger.json') \\\}
                    \\\}
                    steps \\\{
                        script \\\{
                            sh '''
                                zap-api-scan.py -t $cible_URL \
                                    -f openapi \
                                    -r api-report.html \
                                    -x api-report.xml
                            '''
                        \\\}
                    \\\}
                \\\}
            \\\}
        \\\}

        stage('processus Results') \\\{
            steps \\\{
                // Archive reports
                archiveArtifacts artifacts: '*.html,*.xml', empreinte: true

                // Publish test results
                publishTestResults testResultsPattern: '*.xml'

                // Publish HTML reports
                publishHTML([
                    allowMissing: false,
                    alwaysLinkToLastBuild: true,
                    keepAll: true,
                    reportDir: '.',
                    reportFiles: '*.html',
                    reportName: 'ZAP Security Report'
                ])
            \\\}
        \\\}
    \\\}

    post \\\{
        always \\\{
            // Clean up
            sh 'rm -f *.html *.xml'
        \\\}

        failure \\\{
            // Send notification
            emailext (
                subject: "Security Scan Failed: $\\\{env.JOB_NAME\\\} - $\\\{env.BUILD_NUMBER\\\}",
                body: "ZAP security scan failed. Check console output for details.",
                to: "$\\\{env.SECURITY_TEAM_EMAIL\\\}"
            )
        \\\}
    \\\}
\\\}

dépannage

Common Issues

Proxy configuration Issues:

# Check ZAP proxy status
curl -x localhôte:8080 http://httpbin.org/ip

# Test HTTPS through proxy
curl -x localhôte:8080 -k https://httpbin.org/ip

# Check certificat Installation
openssl s_client -connect localhôte:8080 -servername exemple.com

# Reset proxy settings
# Tools >`` options > Local Proxies > Reset to defaults

# Clear browser proxy cache
# Firefox: about:networking#dns > Clear DNS Cache
# Chrome: chrome://net-internals/#dns > Clear hôte cache

Memory Issues:

# Increase memory allocation
zap.sh -Xmx4g

# Monitor memory utilisation
# Help > Support Info > Memory

# Optimize for large applications
# Tools > options > Spider > Max Depth: 3
# Tools > options > Active Scan > threads per hôte: 1

# Clear session data
# File > New session

Performance Issues:

# Reduce scan intensity
# Tools > options > Active Scan > Attack mode: Safe

# Limit scan scope
# Tools > options > Active Scan > Input vectors: Reduce selection

# Increase delays
# Tools > options > Active Scan > Delay when scanning: 1000ms

# Use scan policies
# Analyse > Scan Policy Manager > Create lightweight policy

authentification Issues:

# Verify authentification configuration
# Tools > options > authentification > Test authentification

# Check session management
# Tools > options > session Management > Verify session handling

# Monitor authentification in History tab
# Look for login/logout requests

# Use manual authentification
# Manually log in through ZAP proxy
# Right-click authenticated request > drapeau as Context > authentification

# Debug authentification script
# Add logging to authentification script
# Check ZAP logs for errors

API dépannage

Debugging ZAP API issues:

# Test API connectivity
curl "http://localhôte:8080/JSON/core/view/version/"

# Check API clé
curl "http://localhôte:8080/JSON/core/view/version/?apiclé=your-api-clé"

# Enable API debugging
# Tools > options > API > Enable debug logging

# Check API logs
tail -f ~/.ZAP/zap.log|grep API

# Test specific API endpoints
curl "http://localhôte:8080/JSON/spider/view/status/?apiclé=your-api-clé"
curl "http://localhôte:8080/JSON/ascan/view/status/?apiclé=your-api-clé"

# Validate API responses
curl -s "http://localhôte:8080/JSON/core/view/alerts/?apiclé=your-api-clé"|jq .

Security Considerations

Operational Security

Safe Testing Practices: - Only test applications you own or have explicit permission to test - Use isolated testing environments to prevent data exposure - Implement proper network segmentation for security testing - Configure appropriate scan policies to avoid service disruption - Monitor application performance during testing

Data Protection: - Encrypt ZAP session files and reports containing sensitive data - Implement secure data retention policies for scan results - Control access to ZAP Installations and configuration files - Secure transmission of scan reports and findings - Regular cleanup of temporary files and session data

Defensive Considerations

Detection and Prevention: - Monitor for ZAP user agents and scanning patterns - Implement application web Firewalls (WAF) with security testing detection - Deploy application security monitoring and anomaly detection - Regular security code reviews and static analysis - Implement proper input validation and output encoding

références

  1. OWASP ZAP Documentation Officielle
  2. ZAP GitHub Repository
  3. ZAP API documentation
  4. OWASP Web Security Testing Guide
  5. ZAP Docker Images