Project: secureCodeBox (Provisioning / Security & Compliance)
File: README.md

title: "ZAP Advanced" category: "scanner" type: "WebApplication" state: "released" appVersion: "2.15.0" usecase: "WebApp & OpenAPI Vulnerability Scanner extend with authentication features" <!-- SPDX-FileCopyrightText: the secureCodeBox authors SPDX-License-Identifier: Apache-2.0 --> <!-- .: IMPORTANT! :. -- This file is generated automatically with `helm-docs` based on the following template files: ./.helm-docs/templates.gotmpl (general template data for all charts) ./chart-folder/.helm-docs.gotmpl (chart specific template data) Please be aware of that and apply your changes only within those template files instead of this file. Otherwise your changes will be reverted/overwritten automatically due to the build process `./.github/workflows/helm-docs.yaml` -- --> <p align="center"> <a href="https://opensource.org/licenses/Apache-2.0"><img alt="License Apache-2.0" src="https://img.shields.io/badge/License-Apache%202.0-blue.svg"/></a> <a href="https://github.com/secureCodeBox/secureCodeBox/releases/latest"><img alt="GitHub release (latest SemVer)" src="https://img.shields.io/github/v/release/secureCodeBox/secureCodeBox?sort=semver"/></a> <a href="https://owasp.org/www-project-securecodebox/"><img alt="OWASP Lab Project" src="https://img.shields.io/badge/OWASP-Lab%20Project-yellow"/></a> <a href="https://artifacthub.io/packages/search?repo=securecodebox"><img alt="Artifact HUB" src="https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/securecodebox"/></a> <a href="https://github.com/secureCodeBox/secureCodeBox/"><img alt="GitHub Repo stars" src="https://img.shields.io/github/stars/secureCodeBox/secureCodeBox?logo=GitHub"/></a> <a href="https://infosec.exchange/@secureCodeBox"><img alt="Mastodon Follower" src="https://img.shields.io/mastodon/follow/111902499714281911?domain=https%3A%2F%2Finfosec.exchange%2F"/></a> </p> The Zed Attack Proxy (ZAP) is one of the worlds most popular free security tools and is actively maintained by hundreds of international volunteers*. It can help you automatically find security vulnerabilities in your web applications while you are developing and testing your applications. It's also a great tool for experienced pentesters to use for manual security testing. To learn more about the ZAP scanner itself visit . The zap-advanced chart can be deployed via helm: ```bash helm upgrade --install zap-advanced secureCodeBox/zap-advanced ``` Listed below are the arguments supported by the `zap-advanced-scan` script. The command line interface can be used to easily run server scans: `-t www.example.com` ```bash usage: zap-client [-h] -z ZAPURL [-a APIKEY] [-c CONFIGFOLDER] -t TARGET [-o OUTPUTFOLDER] [-r XML,XML-plus,JSON,JSON-plus,HTML,HTML-plus,MD] OWASP secureCodeBox ZAP Client (can be used to automate ZAP instances based on YAML configuration files.) optional arguments: -h, --help show this help message and exit -z ZAPURL, --zap-url ZAPURL The ZAP API Url used to call the ZAP API. -a APIKEY, --api-key APIKEY The ZAP API Key used to call the ZAP API. -c CONFIGFOLDER, --config-folder CONFIGFOLDER The path to a local folder containing the additional ZAP configuration YAMLs used to configure ZAP. -t TARGET, --target TARGET The target to scan with ZAP. -o OUTPUTFOLDER, --output-folder OUTPUTFOLDER The path to a local folder used to store the output files, eg. the ZAP Report or logfiles. -r XML,XML-plus,JSON,JSON-plus,HTML,HTML-plus,MD, --report-type XML,XML-plus,JSON,JSON-plus,HTML,HTML-plus,MD The ZAP Report Type. ``` Kubernetes: `>=v1.11.0-0` By default, the secureCodeBox ZAP Helm Chart installs the scanType `zap-advanced-scan` along with a minimal default configuration based on the HelmChart value `zapConfiguration`. The configuration will be stored in a dedicate scanType specific configMap named `zap-advanced-scantype-config`. Feel free to use the `configMap` or even the HelmChart values to adjust the advanced ZAP configuration settings according to your needs. Details about the different configuration options can be found below. Additionally, there will be some ZAP Scripts included, these are stored in the corresponding configMaps `zap-scripts-authentication` and `zap-scripts-session`. Scripts can be used to implement a specific behavior or even new authentication patterns, which are not supported by ZAP out of the box. Feel free to add additional scripts in your own, if you need them. ```bash A YAML configuration file for ZAP that This CM contains ZAP authentication relates to the scanType directly. scripts that are already included - will be used for all scans by default within the zap-advanced scanner. - can be configured via Helm Values: Feel free to add your own. zapConfiguration add your baseline config here ConfigMap: zap-scripts-authentication ConfigMap: zap-advanced-scantype-config ZAP Client All scripts are mounted as files Python3 Module directly into the ZAP container. To use All referenced YAML files will be merged into them add a corresponding script section one single YAML configuration. The merged one in your config

will be used to configure the ZAP instance. uses API This CM contains ZAP session A YAML configuration for ZAP that scripts that are already included relates to a single scan execution. within the zap-advanced scanner. - can by used for selected scans Feel free to add your own. ZAP Proxy - not created by default add your scan target specific config ConfigMap: zap-scripts-session - needs to be referenced in Scan please use SecretMap for credentials! secureCodeBox scanner Feel free to add your own scripts :) scanType: zap-advanced ConfigMap: zap-advanced-scan-config ConfigMap: zap-scripts-your-name ``` The following picture outlines the reference concept of the ZAP YAML configuration `zapConfiguration`. If you want to configure an `api` scan, `spider` or active `scan` you must at least add one `context` item with a `name` and `url` configured. The context `url` must match the target url used in the `Scan` execution: ```yaml spec: scanType: "zap-advanced-scan" parameters: "-t" "http://bodgeit.default.svc:8080/bodgeit/" ``` If you want to configure the `api` scan, `spider` or active `scan` section it is mandatory to add the `context: ` reference the section. Otherwise it is not possible to identify which configuration must be used for a scan. The `url` in the `api` , `spider` or active 'scan` section can be different to the context.url (and scan target url). ```bash ZAP Configuration YAML - reference by "context name" Context Context name: ABC - name: XYZ url: ... url: ... API: API: context: ABC - context: XYZ ... - ... Spider: Spider: context: ABC - context: XYZ ... - ... Scanner: Scanner: context: ABC - context: XYZ ... - ... ``` The following YAMl gives you an overview about all the different configuration options you have to configure the ZAP advanced scan. Please have a look into our `./examples/...` to find some working examples. We provide a list of working examples to scan our `demo-targets` with the `zap-advanced-scan`. :::note The YAML format is based on the new but not exactly the same. The ZAP Automation Framework is a new approach of the ZAP Team to ease up the automation possibilities of the ZAP scanner itself. Since this ZAP Automation Framework is not ready yet we are not using it for now. We track the progress in this for the future. The ZAP Automation format represents a more "imperative" semantic, due to the fact that you have to configure sequences of "jobs" containing the steps to configure and automate ZAP. In contrast to that has the secureCodeBox `zap-advanced` YAML format `zapConfiguration` a "declarative" semantic. The similarity of both YAML formats can help to migrate to the ZAP Automation Framework. ::: ```yaml zapConfiguration: global: sessionName: secureCodeBox addonUpdate: true addonInstall: pscanrulesBeta ascanrulesBeta pscanrulesAlpha ascanrulesAlpha includePaths: "https://example.com/.*" excludePaths: ".*\\.js" ".*\\.css" ".*\\.png" ".*\\.jpeg" proxy: enabled: false port: 8080 address: my.corp.proxy skipProxyAddresses: "127.0.0.1" localhost authentication: enabled: false proxyUsername: "" proxyPassword: "" proxyRealm: "" scripts: name: "AlertonHTTPResponseCode_Errors.js" enabled: false filePath: "/home/zap/.ZAPD/scripts/scripts/httpsender/AlertonHTTPResponseCodeErrors.js" engine: "Oracle Nashorn" type: "httpsender" description: "A HTTP Sender Script which will raise alerts based on HTTP Response codes." name: "AlertonUnexpectedContentTypes.js" enabled: false filePath: "/home/zap/.ZAPD/scripts/scripts/httpsender/AlertonUnexpectedContent_Types.js" engine: "Oracle Nashorn" type: "httpsender" description: "A HTTP Sender Script which will raise alerts based on unexpected Content-Types." contexts: name: scbcontext url: https://example.com/ includePaths: "https://example.com/.*" excludePaths: ".*\\.js" ".*\\.css" ".*\\.png" ".*\\.jpeg" technology: included: Db.CouchDB Db.Firebird Db.HypersonicSQL Language.ASP OS excluded: SCM authentication: type: "script-based" script-based: name: scb-oidc-password-grand-type.js enabled: true engine: "Oracle Nashorn" filePath: "/home/zap/.ZAP_D/scripts/scripts/authentication/scb-oidc-password-grand-type.js" description: "This is a description for the SCB OIDC Script." arguments: sub: "secureCodeBox@iteratec.com" email: "secureCodeBox@teratec.com" exp: "1609459140" basic-auth: hostname: "https://example.com/" realm: "Realm" port: 8080 form-based: loginUrl: "http://localhost:8090/bodgeit/login.jsp" loginRequestData: "username%3D%7B%25username%25%7D%26password%3D%7B%25password%25%7D" json-based: loginUrl: "http://localhost:3000/rest/user/login" loginRequestData:

verification: isLoggedInIndicator: "" isLoggedOutIndicator: "" users: name: test-user-1 username: user1 password: password1 forced: true name: test-user-2 username: user2 password: password2 session: type: "scriptBasedSessionManagement" scriptBasedSessionManagement: name: "juiceshop-session-management.js" enabled: true engine: "Oracle Nashorn" fileName: "/home/zap/.ZAP_D/scripts/scripts/session/juiceshop-session-management.js" description: "This is a JuiceShop specific SessionManagement Script used to handle JWT." apis: name: scb-petstore-api context: scb-petstore-context format: openapi url: http://localhost:8000/v2/swagger.json hostOverride: http://localhost:8000 configMap: name: my-configmap-with-openapi-spec key: openapi.yaml spec: null scripts: name: "AlertonHTTPResponseCode_Errors.js" enabled: true name: "AlertonUnexpectedContentTypes.js" enabled: true spiders: name: scbspider context: scbcontext user: "test-user-1" url: https://example.com/ ajax: false failIfFoundUrlsLessThan: 0 warnIfFoundUrlsLessThan: 0 maxDuration: 0 maxDepth: 5 maxChildren: 10 acceptCookies: true handleODataParametersVisited: false handleParameters: use_all maxParseSizeBytes: 2621440 parseComments: true parseGit: false parseRobotsTxt: true parseSitemapXml: true parseSVNEntries: false postForm: true processForm: true requestWaitTime: 200 sendRefererHeader: true threadCount: 2 userAgent: "secureCodeBox / ZAP Spider" scripts: {} scanners: name: scbscan context: scbcontext url: https://example.com/ defaultPolicy: "Default Policy" policy: "Default Policy" maxRuleDurationInMins: 0 maxScanDurationInMins: 0 delayInMs: 0 addQueryParam: false handleAntiCSRFTokens: false injectPluginIdInHeader: false scanHeadersAllRequests: false threadPerHost: 2 policyDefinition: defaultStrength: Medium defaultThreshold: Medium rules: id: 10106 name: "rule" strength: Medium threshold: Low scripts: {} ``` | Key | Type | Default | Description | |--|||-| | cascadingRules.enabled | bool | `false` | Enables or disables the installation of the default cascading rules for this scanner | | imagePullSecrets | list | `[]` | Define imagePullSecrets when a private registry is used (see: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/) | | parser.affinity | object | `{}` | Optional affinity settings that control how the parser job is scheduled (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/) | | parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | | parser.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | parser.image.repository | string | `"docker.io/securecodebox/parser-zap"` | Parser image repository | | parser.image.tag | string | defaults to the charts version | Parser image tag | | parser.nodeSelector | object | `{}` | Optional nodeSelector settings that control how the scanner job is scheduled (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes/) | | parser.resources | object | `{ requests: { cpu: "200m", memory: "100Mi" }, limits: { cpu: "400m", memory: "200Mi" } }` | Optional resources lets you control resource limits and requests for the parser container. See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | | parser.scopeLimiterAliases | object | `{}` | Optional finding aliases to be used in the scopeLimiter. | | parser.tolerations | list | `[]` | Optional tolerations settings that control how the parser job is scheduled (see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) | | parser.ttlSecondsAfterFinished | string | `nil` | seconds after which the Kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | | scanner.activeDeadlineSeconds | string | `nil` | There are situations where you want to fail a scan Job after some amount of time. To do so, set activeDeadlineSeconds to define an active deadline (in seconds) when considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#job-termination-and-cleanup) | | scanner.affinity | object | `{}` | Optional affinity settings that control how the scanner job is scheduled (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/) | | scanner.backoffLimit | int | 3 | There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) | | scanner.env | list | `[]` | Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | | scanner.envFrom | list | `[]` | Optional mount environment variables from configMaps or secrets (see: https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#configure-all-key-value-pairs-in-a-secret-as-container-environment-variables) | |

| list | `[]` | Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) | | scanner.extraVolumeMounts | list | `[{"mountPath":"/home/securecodebox/configs/1-zap-advanced-scantype.yaml","name":"zap-advanced-scantype-config","readOnly":true,"subPath":"1-zap-advanced-scantype.yaml"}]` | Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.extraVolumes | list | `[{"configMap":{"name":"zap-advanced-scantype-config","optional":true},"name":"zap-advanced-scantype-config"},{"configMap":{"name":"zap-scripts-authentication"},"name":"zap-scripts-authentication"},{"configMap":{"name":"zap-scripts-session"},"name":"zap-scripts-session"}]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | scanner.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | scanner.image.repository | string | `"docker.io/securecodebox/scanner-zap-advanced"` | Container Image to run the scan | | scanner.image.tag | string | `nil` | defaults to the charts version | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.nodeSelector | object | `{}` | Optional nodeSelector settings that control how the scanner job is scheduled (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes/) | | scanner.podSecurityContext | object | `{}` | Optional securityContext set on scanner pod (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | | scanner.reportType | string | "XML" | Optional to configure the reportType of the scan ZAP Scan. Must be one of the supported formats: XML,XML-plus,JSON,JSON-plus,HTML,HTML-plus,MD | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | | scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":false,"runAsNonRoot":false}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | | scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | | scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | | scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | | scanner.securityContext.readOnlyRootFilesystem | bool | `false` | Prevents write access to the containers file system | | scanner.securityContext.runAsNonRoot | bool | `false` | Enforces that the scanner image is run as a non root user | | scanner.suspend | bool | `false` | if set to true the scan job will be suspended after creation. You can then resume the job using `kubectl resume <jobname>` or using a job scheduler like kueue | | scanner.tolerations | list | `[]` | Optional tolerations settings that control how the scanner job is scheduled (see: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the Kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | | zapConfiguration | object | `{}` | All `scanType` specific configuration options. Feel free to add more configuration options. All configuration options can be overridden by scan specific configurations if defined. Please have a look into the README.md to find more configuration options. | | zapContainer.env | list | `[]` | Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) | | zapContainer.envFrom | list | `[]` | Optional mount environment variables from configMaps or secrets (see: https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#configure-all-key-value-pairs-in-a-secret-as-container-environment-variables) | | zapContainer.extraVolumeMounts | list | `[{"mountPath":"/home/zap/.ZAPD/scripts/scripts/authentication/","name":"zap-scripts-authentication","readOnly":true},{"mountPath":"/home/zap/.ZAPD/scripts/scripts/session/","name":"zap-scripts-session","readOnly":true}]` | Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) | | zapContainer.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | zapContainer.image.repository | string | `"softwaresecurityproject/zap-stable"` | Container Image to run the scan | | zapContainer.image.tag | string | `nil` | defaults to the charts appVersion | | zapContainer.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | | zapContainer.securityContext.allowPrivilegeEscalation | bool | `false` | | | zapContainer.securityContext.capabilities.drop[0] | string | `"all"` | | | zapContainer.securityContext.privileged | bool | `false` | | | zapContainer.securityContext.readOnlyRootFilesystem | bool | `false` | | | zapContainer.securityContext.runAsNonRoot | bool | `false` | | ](https://opensource.org/licenses/Apache-2.0) Code of secureCodeBox is licensed under the .