OWASP ZAP module
OWASP ZAP has an API that we can use. Additionally, there is a Python module for consuming the API. We will try and use that to learn how to write our own Ansible modules.
Create ZAP using Docker
For our development, let's use a Docker container to get ZAP going. Since we plan to use the API, we will run the container in headless mode:
$ docker run -u zap -p 8080:8080 -i owasp/zap2docker-stable zap.sh -daemon -host 0.0.0.0 -port 8080 -config api.disablekey=true -config api.addrs.addr.name=.* -config api.addrs.addr.regex=true
Explanation of the command
- While we are doing dev, we can disable the API key:
-config api.disablekey=true - Allow access to the API from any IP:
-config api.addrs.addr.name=.* -config api.addrs.addr.regex=true - Listen to port
8080
If everything worked fine, you will see the following output:
Creating a vulnerable application
For a vulnerable application, we can host one of our own but let's use the same online vulnerable application we used for the OWASP ZAP + Jenkins...
