shellselenium-webdriverowaspzapzapier-cli

Selenium script execution scanning by OWASP ZAP docker

I know one method is with "https://dzone.com/articles/automate-zap-security-tests-with-selenium-webdrive-1"

But are there direct commands that can scan our selenium application execution by OWASP ZAP?.

  1. Run proxied OWASP ZAP on the background.
  2. execute our independent selenium script for execution.(especially covering login ).
  3. Spidering if possible else collect the report.

I think it should be possible then a full project. Very few sites are available openly or without login.

Solution

  • You can user docker.

    1. Install or pull docker image -

      " docker pull owasp/zap2docker-stable "

    2. You can start the ZAP in headless mode with following command -

      " docker run -u zap -p 8080:8080 -i owasp/zap2docker-stable zap.sh -daemon -host 0.0.0.0 -port 8080 -config api.addrs.addr.name=.* -config api.addrs.addr.regex=true -config api.disablekey=true "

    3. Run your Selenium tests independently but within selenium tests configure the proxy to hit port 8080 (or whichever you are using).

    4. The following command will generate report in the container -

      " docker exec $container_Id zap-cli report -o vulnerability.html -f HTML "

    you can copy this report anywhere. Then stop the container and remove it.