Case 1 – web security scanning with ZAP-CLI

In this small NodeGoat web security testing scenario, we will automate OWASP ZAP by using the ZAP-CLI for security smoke testing. The ZAP-CLI provides a quick scan, which is handy because it achieves the following in one command:

• Open a URL to the target website
• Spider scan to discover web resources (URLs) extensively on the target website
• Active scan to identify more potential security issues by using known attacks

We will perform the following steps to execute the ZAP-CLI and review the security results by

Step 1 – installation of ZAP-CLI

Assuming you have installed OWASP ZAP, the installation of the ZAP-CLI can be easily done with this command:

$ pip install ...