Skip to content

Instantly share code, notes, and snippets.

@lokori
Forked from ian-bartholomew/zap_cli_scan.sh
Created October 31, 2017 12:14
Show Gist options
  • Save lokori/246c29e172a2045635e45a0fc8604e26 to your computer and use it in GitHub Desktop.
Save lokori/246c29e172a2045635e45a0fc8604e26 to your computer and use it in GitHub Desktop.
script to run owasp zap cli
#!/bin/sh
DOCKER=`which docker`
IMAGE='owasp/zap2docker-weekly'
URL='https://www.example.com'
ZAP_API_PORT='8090'
# Start our container
CONTAINER_ID=`$DOCKER run -d \
-p $ZAP_API_PORT:$ZAP_API_PORT \
-v $PWD:/zap/reports:rw \
-i $IMAGE zap.sh \
-daemon -port $ZAP_API_PORT \
-host 0.0.0.0 \
-config api.disablekey=true`
# set up our status spinner
spin='-\|/'
i=0;
# Poll the api and wait for it to start up
while ! curl -s http://0.0.0.0:$ZAP_API_PORT > /dev/null
do
i=$(( (i+1) %4 ))
printf "\rWaiting for OWASP ZAP to start ${spin:$i:1}"
sleep .1
done
echo "\nZAP has successfully started"
# Open the provided url
$DOCKER exec $CONTAINER_ID \
zap-cli -p $ZAP_API_PORT open-url $URL
# Spider the site
$DOCKER exec $CONTAINER_ID \
zap-cli -v -p $ZAP_API_PORT spider $URL
# Scan the site
$DOCKER exec $CONTAINER_ID \
zap-cli -v -p $ZAP_API_PORT active-scan \
--recursive $URL
# Show any alerts
$DOCKER exec $CONTAINER_ID \
zap-cli -p $ZAP_API_PORT alerts -l Low
# Generate our report
$DOCKER exec $CONTAINER_ID \
zap-cli -p $ZAP_API_PORT report \
-o /zap/reports/report.html -f html
# Shut down the docker image
$DOCKER kill $CONTAINER_ID
@jason-yardley
Copy link

nice script but when i try run it, OWASP gets stuck - "Waiting for OWASP ZAP to start /".
Ive tried changing the ports and zap image (stable, weekly etc).
Could it be stuck due to the URLs i am targeting require authentication?

im running on Ubuntu 18.04.2 LTS :
Version: 18.09.2
API version: 1.39
Go version: go1.10.4
Git commit: 6247962
Built: Tue Feb 26 23:52:23 2019
OS/Arch: linux/amd64

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment