Automatic security tests in Jenkins with OWASP ZAP
Tags: devops, websecuritytesting, owasp, zap
Published: 2018-10-11 07:44:22

---
title: Automatic security tests in Jenkins with OWASP ZAP
published: true
tags: devops,web-security-testing,owasp,zap
canonical_url: 
---

![](https://cdn-images-1.medium.com/max/790/1*6qCQfcu5ZX7Eq_C1mqOLqA.png)

[OWASP ZAP](https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project) is a very popular tool used to find vulnerabilities in your codebase and in your instance/server setup.

![](https://cdn-images-1.medium.com/max/64/1*Ar8NCL0OVmq0GU6wzzxSQA.png)<figcaption>OWASP ZAP logo</figcaption>

What it basically does is crawl through your website and then scan for vulnerabilities on all the URLs it found during the crawl.

A **session** is an instance of a test. Inside a session you can have multiple contexts.

**Contexts** help ZAP only scan the URLs you want.

For example if you include directly bootstrap in your pages with:

```
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css">
```

ZAP will inevitably find this URL. And since you most certainly don’t want ZAP to scan [https://maxcdn.bootstrapcdn.com](https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css) for vulnerabilities, you exclude it of the context.  
So you include or exclude URLs from the context based on what you want it to scan.

Before following this guide, you should probably play the OWASP ZAP client on your computer to **understand the basic concepts**.

Brace yourself it’s going to be a long journey to setup the OWASP ZAP Jenkins plugin!

### Download and install OWASP ZAP on your Jenkins instance

Go to [https://github.com/zaproxy/zaproxy/wiki/Downloads](https://github.com/zaproxy/zaproxy/wiki/Downloads) and download the version of the client for your platform.

Unzip it and move the folder to /usr/local/bin for example.

Then set the environment variable ZAPROXY\_HOME to the path of your ZAP proxy installation folder:

```
vim /etc/environment
```

and paste the following content:

```
ZAPROXY\_HOME=/usr/local/bin/ZAP\_2.x.x/
```

### Install the OWASP ZAP plugin

To install the official OWASP ZAP plugin on your Jenkins instance go toManage Jenkins -\> Manage Plugins -\> Available (it is a tab) -\> look for OWASP ZAP.

![](https://cdn-images-1.medium.com/max/574/1*1A4Zmuc0rk27mc2SJrp8gg.png)<figcaption>plugin to install</figcaption>

Install it.

Configure the plugin by going to Manage Jenkins -\> Configure System and filling out the following fields.

![](https://cdn-images-1.medium.com/max/885/1*W0-GYn-rWI_EHTcRChsYNA.png)<figcaption>Port 8089 is an example, you can choose the port you want here</figcaption>

### Create a new Jenkins job

Create a new freestyle project and fill in the following fields:

- Discard old builds

![](https://cdn-images-1.medium.com/max/934/1*xlaV6P8g3UTvccOrtmjwnw.png)<figcaption>To make sure our project doesn’t use too much space</figcaption>

- Build Trigger (optional)

![](https://cdn-images-1.medium.com/max/934/1*SttXjjWEcSNadq9cGLQJ5Q.png)<figcaption>To run the job every sunday at 2AM</figcaption>

- Add the Execute ZAP build step

Inside the Execute ZAP build step:

![](https://cdn-images-1.medium.com/max/899/1*hbOocOWkKTMZqfbg2Mw0WQ.png)<figcaption>It should reflect the fields values filled in the step where you installed the plugin</figcaption>

![](https://cdn-images-1.medium.com/max/896/1*rM_ePR_RP5dI3ssh23HHmg.png)<figcaption>Specifies where the OWASP ZAP bin is installed on our Jenkins instance</figcaption>

![](https://cdn-images-1.medium.com/max/887/1*kinmgLX05-2oLHsv4NZoDg.png)<figcaption>Should be the path to the directory of the Jenkins job you are creating</figcaption>

![](https://cdn-images-1.medium.com/max/901/1*gpgt_r0xG2p9lC1jc68Tsg.png)<figcaption>Remember when we talked about context? Here you specify which URLs should be included and excluded. Here <a href="http://10.0.40.3">http://10.0.40.3</a> is where I host the website I want to test. The * means that I want ZAP to include in the context all the URLs starting by http://10.0.40.3</figcaption>

![](https://cdn-images-1.medium.com/max/898/1*ZfdzD883IYrAG19Ujo6pqQ.png)<figcaption>Tell ZAP to first crawl for URLs and then scan the URLs it found</figcaption>

![](https://cdn-images-1.medium.com/max/900/1*WLPR-d8-OEQ8OMsxi9DHFQ.png)<figcaption>Tell ZAP which reports to generate and where to place them</figcaption>

Finally go back to the Session Management section which requires more explanation than the other ones:

If you tick the checkbox Persist Session ZAP will create a new session for you. It is the easiest option to setup but also the least thorough.

You see if your web application has a login page, ZAP won’t know the credentials to use in order to gain access to the private zone of your web app. So ZAP will only attack the public part of your website and miss a good portion of it.

To help ZAP know the credentials, what you would have to do is use the GUI client on your computer to generate a ZAP session in which you assign a valid session cookie for example. You would then export and upload the session you created to your new Jenkins Job folder and then tick the Load Session checkbox and select your session in the select list.

![](https://cdn-images-1.medium.com/max/897/1*08Jz7vF8gyH55fyrXMe57w.png)<figcaption>For our basic example we will tick the Persist Session checkbox</figcaption>

- Add a Publish HTML reports post-build step

![](https://cdn-images-1.medium.com/max/928/1*eRnZdkHf5dAD_NvJCan7-Q.png)

And that’s it! Either manually build the job or wait for your cron schedule to execute it and you should see the HTML report of ZAP tests in your Jenkins job dashboard.

![](https://cdn-images-1.medium.com/max/179/1*Ub5D2hgoSsIcR12MtH1KFg.png)<figcaption>Click on Vulnerability Report to see the results of the security tests</figcaption>

Let me know if I missed anything!