Owasp-Zap on Commentary of Takao

OWASP ZAP in 2026: Advanced Scanning and CI/CD Integration

Tue, 09 Jun 2026 00:00:00 +0900

Beyond Basic Scanning

OWASP ZAP has evolved significantly since its early days. In 2026, it is no longer just a point-and-click proxy scanner — it is a full-featured security automation platform with a powerful API, a scriptable automation framework, and deep CI/CD integration. If you need the basics first, read our OWASP ZAP 설치 and setup 가이드. This article covers advanced workflows for teams running security tests at scale.

API Scanning with ZAP

Modern applications rely heavily on REST and GraphQL APIs. ZAP’s OpenAPI and GraphQL support allows you to scan APIs without a browser.

Importing an OpenAPI Specification

# Via ZAP API
curl "http://localhost:8080/JSON/openapi/action/importUrl/?url=https://example.com/openapi.json&host=example.com"

ZAP parses the specification and generates requests for every endpoint and parameter combination. For GraphQL APIs, provide the endpoint URL and schema introspection:

curl "http://localhost:8080/JSON/graphql/action/importUrl/?endpointUrl=https://api.example.com/graphql"

Automated Form 인증

Modern web apps use complex 인증 flows. ZAP supports several auth methods:

Method	When to Use
Browser-based	OAuth2, SSO, 로그인 flows with redirects
JSON-based	REST API with token-based auth
Script-based	Custom or legacy auth mechanisms

Configure 인증 via the Context panel in the ZAP 데스크탑, or automate it through the API:

# Set authentication credentials via ZAP API
curl "http://localhost:8080/JSON/authentication/action/setAuthenticationMethod/" \
 -d "contextId=1&authMethodName=browserBasedAuth&authMethodConfigParams=loginUrl=https://app.example.com/login&loginPageUrl=https://app.example.com/login"

ZAP Automation Framework

Introduced in ZAP 2.12, the Automation Framework replaces traditional shell scripts with declarative YAML-based plans. This is the recommended approach for 2026.

env:
 contexts:
 - name: "my-app"
 urls:
 - "https://staging.example.com"
jobs:
 - type: spider
 parameters:
 maxChildren: 10
 - type: passiveScan-config
 parameters:
 maxAlertsPerRule: 50
 - type: activeScan
 parameters:
 maxScansInUI: 1
 - type: report
 parameters:
 template: "traditional-html"
 reportDir: "./reports"
 reportFile: "zap-report-{{date}}.html"

Run the plan headlessly:

zap.sh -cmd -autorun /path/to/plan.yaml

This approach is reproducible, 버전-controllable, and removes the need for manual UI interaction. All job types (spider, activeScan, ajaxSpider, report, etc.) are configurable via YAML.

CI/CD Pipeline Integration

ZAP integrates natively into GitHub Actions, GitLab CI, and Jenkins. The official ZAP Docker image (softwaresecurityproject/zap-stable) makes this straightforward.

GitHub Actions Example

jobs:
 zap-scan:
 runs-on: ubuntu-latest
 steps:
 - uses: actions/checkout@v4
 - name: Run ZAP scan
 uses: zaproxy/action-full-scan@v0.12
 with:
 target: "https://staging.example.com"
 token: ${{ secrets.ZAP_API_KEY }}
 rules_file_name: ".zap/rules.tsv"
 cmd_options: "-a"

GitLab CI Example

zap-scan:
 image: softwaresecurityproject/zap-stable
 script:
 - mkdir -p reports
 - zap.sh -cmd -quickurl https://staging.example.com -quickprogress -quickout reports/zap.html
 artifacts:
 paths:
 - reports/

Fail on High-Risk Issues

Prevent vulnerable code from reaching production by enforcing a quality gate:

zap.sh -cmd -autorun plan.yaml
# Parse the report and exit with non-zero if high-risk alerts exist
if grep -q '"risk": "High"' reports/zap-report.json; then
 echo "High-risk vulnerabilities detected!"
 exit 1
fi

Context-Based Scanning

Define contexts to scope scans to specific applications, preventing ZAP from wandering into third-party domains:

env:
 contexts:
 - name: "my-app"
 urls:
 - "https://app.example.com"
 includePaths:
 - "/api/.*"
 - "/app/.*"
 excludePaths:
 - "/logout"
 authentication:
 method: "browserBasedAuth"
 parameters:
 loginUrl: "https://app.example.com/login"

Contexts also store session tokens, user credentials, and technology detection results, making scans more accurate and less noisy.

WebSocket Scanning

ZAP now supports WebSocket traffic interception and fuzzing. This is critical for modern applications that rely on real-time communication:

jobs:
 - type: websocket
 parameters:
 scanMessageList:
 - "{\"type\": \"ping\"}"
 - "{\"type\": \"subscribe\", \"channel\": \"admin\"}"

WebSocket fuzzing can reveal message injection vulnerabilities, unexpected error responses, and authorization bypasses in real-time 기능.

Reducing False Positives

Alert filtering and threshold tuning improve signal-to-noise ratio. Set scan strength per rule:

jobs:
 - type: activeScan
 parameters:
 alertThreshold: "MEDIUM"
 attackStrength: "DEFAULT"
 - type: passiveScan-config
 parameters:
 maxAlertsPerRule: 10
 alertFilters:
 - ruleId: 10010
 newRisk: "False Positive"
 url: ".*healthcheck.*"

Maintain a .zap/rules.tsv file to 커스터마이즈 rule thresholds across all scans in your pipeline.

Conclusion

OWASP ZAP in 2026 is a mature, API-first security platform that fits seamlessly into modern development workflows. From declarative YAML plans to CI/CD quality gates, ZAP enables teams to find and fix vulnerabilities before they reach production. Pair it with the basics covered in our earlier 가이드 for a complete security testing strategy.

OWASP ZAP: Web Application Security Testing Guide

Fri, 20 Oct 2023 00:00:00 +0900

OWASP ZAP: Web Application Security Testing 가이드

Web application security is no longer optional — it is a fundamental requirement for protecting user data and maintaining trust. OWASP ZAP (Zed Attack Proxy) is one of the most popular open-source security testing tools available. It helps developers and security professionals identify vulnerabilities in web applications through automated scanning and manual testing 기능. This 가이드 covers the full workflow, from 설치 to remediation.

Step 1: Installing OWASP ZAP

ZAP runs on Windows, macOS, and Linux. Choose the instructions for your platform.

Windows

Visit the official ZAP 다운로드 page.
다운로드 the latest stable Windows installer (.exe).
Run the installer and follow the setup wizard.
Launch ZAP from the Start menu or 데스크탑 shortcut.

macOS

Go to the official ZAP 다운로드 page and 다운로드 the macOS package.
Mount the .dmg file and drag ZAP to your Applications folder.
Open ZAP from Applications. If macOS blocks it, go to System 설정 > Privacy & Security and allow the app.
Alternatively, install via Homebrew: brew install --cask zap.

Linux (Debian/Ubuntu)

sudo apt-get update
sudo apt-get install zaproxy

After 설치, launch ZAP from the terminal with zaproxy or find it in your application menu.

Step 2: Configuring the Target Application

Once ZAP is running, you need to define the scope of your test:

On the welcome 화면, click Quick Start and then Set up a new Context.
A context defines the boundaries of the application you are testing — its URLs, 인증 methods, and technical environment.
Under Include in Context, add the base URL of the target application (e.g., https://example.com).
Click Include to confirm. You can add multiple URLs if the application spans several domains.
Click Finish to save the context.

Properly scoping the context ensures that ZAP focuses its scans only on the intended target and avoids accidentally testing third-party services.

Step 3: Running an Active Scan

Active scanning attempts to find vulnerabilities by sending malicious payloads to the application and observing the responses. This is the core of ZAP’s automated testing capability:

In the left navigation pane, select the Sites tree. Find your target URL.
Right-click the target and choose Attack > Active Scan.
ZAP will begin sending requests designed to probe for common vulnerabilities such as SQL injection, cross-site scripting (XSS), and path traversal.
The scan progress appears in the bottom panel. Depending on the size of the application, this may take several minutes.

When the scan completes, results appear in the Alerts tab, organized by risk level (High, Medium, Low, Informational).

Alert Risk Levels

Risk Level	Example	Action Required
High	SQL Injection, RCE	Immediate remediation
Medium	XSS, CSRF	Fix in current sprint
Low	Missing security headers	Address in next release
Informational	서버 banner disclosure	Review and document

Step 4: Passive Scanning

Passive scanning observes traffic without sending any malicious payloads. It analyzes requests and responses as they pass through ZAP’s proxy, identifying issues like missing security headers, cookie misconfigurations, and information leaks:

Ensure the Passive Scan toggle is enabled in the main toolbar.
Browse the target application normally through ZAP’s proxy (by default, ZAP listens on localhost:8080).
As you navigate, ZAP silently analyzes every request and response.
Issues detected by the passive scanner appear in the Alerts tab alongside active scan results.

Passive scanning is safe to run against any application because it does not modify requests. It is an excellent starting point for a preliminary security assessment.

To 커스터마이즈 scan 설정, go to Tools > Options and adjust thresholds under Passive Scan Rules.

Step 5: Generating Reports

After scanning, share the results with your team. ZAP supports multiple report formats:

From the menu bar, select Report > Generate Report.
Choose your preferred format:
- HTML: Human-readable report with charts and severity breakdowns.
- XML: Machine-readable for integration with other tools.
- JSON: Structured data suitable for programmatic processing.
커스터마이즈 which alerts to include by risk level.
Click Generate Report and save the file.

Reports include descriptions of each vulnerability, the affected URL, evidence from the scan, and remediation advice. Share these with developers to prioritize fixes.

Step 6: Fixing and Retesting

Identifying vulnerabilities is only half the battle — the real value comes from fixing them and verifying the fixes:

Work with the development team to address each vulnerability. ZAP’s alert details often include specific code-level guidance.
After fixes are deployed, run a new active scan against the same context to confirm the issues are resolved.
Compare the new alert list with the original report. All previously flagged High and Medium issues should be gone or reduced in severity.
Repeat this cycle regularly. Security testing is not a one-time activity — integrate it into your CI/CD pipeline.

For automated pipelines, ZAP offers a headless mode and Docker images that can be invoked from the command line:

docker run -v $(pwd):/zap/wrk/:rw -t ghcr.io/zaproxy/zaproxy:stable \
 zap-full-scan.py \
 -t https://example.com \
 -r report.html

Summary

OWASP ZAP is a powerful, free tool that puts professional-grade security testing within reach of every development team. By mastering active scanning, passive analysis, report generation, and retesting workflows, you can dramatically improve your application’s security posture. Make ZAP a regular part of your development lifecycle and build security into your software from the start.