ZAP Website

https://github.com/zaproxy/zaproxy-website
Admin
Website for ZAP one of the world's most popular free security tools.
Tokens:768,366
Snippets:7,951
Trust Score:8.7
License:MIT
Update:4 weeks ago
Show doc for...
Tokens:
Raw
### Setup: Clone and Install Dependencies

Source: https://github.com/zaproxy/zaproxy-website/blob/main/CONTRIBUTING.md

Clone the repository and install npm dependencies. Run these commands in your terminal to set up the project locally.

```sh
$ git clone https://github.com/zaproxy/zaproxy-website
$ cd zaproxy-website
$ npm install
```

--------------------------------

### Quick Start Command Line Options

Source: https://github.com/zaproxy/zaproxy-website/blob/main/site/content/docs/desktop/addons/quick-start/cmdline.md

Command line options for the Quick Start add-on, including -quickurl, -quickout, -quickprogress, and -zapit, with usage examples.

```APIDOC
## Command Line Options

### Description
These command line options are supported by the Quick Start add-on for ZAP.

### Options

#### -quickurl
- **Type**: string
- **Required**: Yes (for attack)
- **Description**: Specifies the URL of the target application that will be attacked.

#### -quickout
- **Type**: string
- **Required**: No
- **Description**: Specifies the file to write the report to. The report format will depend on the file extension - supported file extensions are `.html`, `.json`, `.md`, `.xml`. If none of these extensions are used then the format will be XML. If not set in 'inline' and daemon modes the report is written to default output stream.

#### -quickprogress
- **Type**: flag
- **Required**: No
- **Description**: Show ascii progress bars, if started with the `-cmd` flag.

#### -zapit
- **Type**: flag
- **Required**: No
- **Description**: Perform a quick ['ZAPit'](/docs/desktop/addons/quick-start/zapit/) 'reconnaissance' scan of URL specified, the `-cmd` flag must also be set.

### Examples

#### Start ZAP in 'inline' mode with ascii progress bars, attack the target application http://example.com/ and write the report to default output stream:

```
-cmd -quickurl http://example.com/ -quickprogress
```

#### Start ZAP with UI, attack the target application http://example.com/ and save the report to a file:

```
-quickurl http://example.com/ -quickout /path/to/report.xml
```
```

--------------------------------

### Install ZAP add-ons via command line

Source: https://github.com/zaproxy/zaproxy-website/blob/main/site/content/blog/2017-04-03-exploring-apis-with-zap/index.md

Install the SOAP and OpenAPI add-ons from the ZAP Marketplace via the command line. Start ZAP with these flags to install the add-ons automatically.

```sh
./zap.sh -addoninstall soap -addoninstall openapi
```

--------------------------------

### Install X, dmenu, i3, and lxde

Source: https://github.com/zaproxy/zaproxy-website/blob/main/site/content/blog/2022-08-25-zap-on-raspberry-pi/index.md

Installs a lightweight desktop environment and window manager. The --no-install-recommends flag keeps the installation minimal.

```bash
sudo apt update && sudo apt upgrade && sudo apt install xserver-xorg-core xserver-xorg-video-fbdev xserver-xorg-input-evdev xinit xfonts-base lxde  --no-install-recommends -y
```

--------------------------------

### Alert override example

Source: https://github.com/zaproxy/zaproxy-website/blob/main/site/content/docs/desktop/start/features/alerts.md

Example of an alert override configuration file. Lines starting with '#' are comments. This example overrides the solution for alert 40012 and adds a tag with a URL.

```properties
# 40012 = Reflected XSS
40012.solution = Follow our company specific guidelines at http://internet.example.com/xss.html
40012.tag.Bug\ Tracker\ URL = https://example.com/issues/1234
```

--------------------------------

### Review: Start Development Server

Source: https://github.com/zaproxy/zaproxy-website/blob/main/CONTRIBUTING.md

Start the local development server to preview changes. This is the first step in the review process.

```sh
$ npm run start
```

--------------------------------

### Start a Client Spider scan

Source: https://github.com/zaproxy/zaproxy-website/blob/main/site/content/docs/desktop/addons/client-side-integration/spider-api.md

Example URL to start a Client Spider scan with specified parameters: maxCrawlDepth=5, pageLoadTime=30, numberOfBrowsers=1, and scopeCheck=STRICT.

```http
https://zap/JSON/clientSpider/action/scan/?url=https://example.com&maxCrawlDepth=5&pageLoadTime=30&numberOfBrowsers=1&scopeCheck=STRICT
```

--------------------------------

### Quick Start: Run ZAP against crAPI with Docker

Source: https://github.com/zaproxy/zaproxy-website/blob/main/site/content/docs/testapps/crapi.md

Run these commands to set up crAPI and launch ZAP with the FullScanCrApiAuth.yaml plan. The commands create a 'crapi' directory, download the docker-compose and plan, then run ZAP in Docker. The network name depends on the current working directory name, so using 'crapi' is required. The plan includes user registration requests for authentication.

```bash
mkdir crapi
cd crapi
curl -o docker-compose.yml https://raw.githubusercontent.com/OWASP/crAPI/refs/heads/main/deploy/docker/docker-compose.yml

# Start crapi
docker-compose up

# Download the recommended plan using curl, or use any other suitable tool
curl -O https://raw.githubusercontent.com/zaproxy/community-scripts/refs/heads/main/other/af-plans/FullScanCrApiAuth.yaml

# Run ZAP using the stable Docker image, the crapi docker network, 
# mapping the CWD so that Docker can access the file system and export the report.
# The network name is based on the cwd name, which is why creating and using "crapi" is important
docker run --network crapi_default -v $(pwd):/zap/wrk/:rw -t zaproxy/zap-stable zap.sh -cmd -autorun wrk/FullScanCrApiAuth.yaml
```

--------------------------------

### Dockerfile to install Chrome in ZAP image

Source: https://github.com/zaproxy/zaproxy-website/blob/main/site/content/faq/how-do-i-use-chrome-with-zap-in-docker.md

Use this Dockerfile to create a ZAP image with Chrome installed. It starts from the zaproxy/zap-stable image, switches to root to install Chrome, and then switches back to the zap user.

```dockerfile
FROM --platform=linux/amd64 zaproxy/zap-stable:latest

USER root

RUN apt-get update && \
	wget -q https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb && \
	apt-get install -y ./google-chrome-stable_current_amd64.deb && \
	rm -rf /var/lib/apt/lists/*

USER zap
```

--------------------------------

### Copy Simple Example add-on on Linux/macOS

Source: https://github.com/zaproxy/zaproxy-website/blob/main/site/content/docs/developer/creating-new-addon-in-zap-extensions.md

Command-line command to copy the Simple Example add-on to a new directory named 'myaddon' on Linux and macOS. It should be run from the 'zap-extensions' directory.

```bash
cp -R addOns/simpleexample addOns/myaddon
```

--------------------------------

### Example output from -suppinfo

Source: https://github.com/zaproxy/zaproxy-website/blob/main/site/content/faq/how-do-i-see-what-version-of-an-add-on-extension-i-have-installed.md

Example output from the -suppinfo command, showing the ZAP version, installed add-ons with their versions, and system details. The output is truncated with '...snip...' in the add-ons list.

```text
OWASP ZAP
Version: 2.8.0
Installed Add-ons: [[id=alertFilters, version=8.0.0], [id=ascanrules, version=33.0.0], [id=bruteforce, version=8.0.0]
...snip...
[id=tips, version=6.0.0], [id=webdriverwindows, version=10.0.0], [id=websocket, version=19.0.0], [id=zest, version=29.0.0]]
Operating System: Windows 7
Java Version: Oracle Corporation 1.8.0_191
System's Locale: en_CA
Display Locale: en_GB
Format Locale: en_GB
ZAP Home Directory: C:\Users\someone\OWASP ZAP\
ZAP Installation Directory: C:\Program Files\OWASP\Zed Attack Proxy\.\
Look and Feel: Metal (javax.swing.plaf.metal.MetalLookAndFeel)
```

--------------------------------

### Copy Simple Example add-on on Windows

Source: https://github.com/zaproxy/zaproxy-website/blob/main/site/content/docs/developer/creating-new-addon-in-zap-extensions.md

Command-line command to copy the Simple Example add-on to a new directory named 'myaddon' on Windows, using xcopy with /E and /H flags. It should be run from the 'zap-extensions' directory.

```bash
xcopy addOns\simpleexample addOns\myaddon\ /E/H
```

--------------------------------

### Quick Start Commands: Download Plan and Run ZAP Docker

Source: https://github.com/zaproxy/zaproxy-website/blob/main/site/content/docs/testapps/ginnjuiceshop.md

These commands download the recommended ZAP automation plan and run ZAP in Docker to scan Gin & Juice Shop. The plan is for a full scan with authentication. The Docker run mounts the current working directory to /zap/wrk/ and exports an HTML report there. Expected to take about 25 minutes and find several high and medium risk alerts.

```bash
curl -O https://raw.githubusercontent.com/zaproxy/community-scripts/refs/heads/main/other/af-plans/FullScanGinNJuiceAuth.yaml

docker run -v $(pwd):/zap/wrk/:rw -t zaproxy/zap-stable zap.sh -cmd -autorun wrk/FullScanGinNJuiceAuth.yaml
```
Tokens:
Raw