A GitHub Action for running the OWASP ZAP API Scan to perform Dynamic Application Security Testing (DAST).
The ZAP api scan action uses the api definition to scan before reporting the results. The alerts will be maintained as a GitHub issue in the corresponding repository.
WARNING this action will perform attacks on the target website. You should only scan targets that you have permission to test. You should also check with your hosting company and any other services such as CDNs that may be affected before running this action. ZAP will also submit forms which could result in a large number of messages via, for example, 'Contact us' or 'comment' forms.
Required The file/URL where to find the definition of the api to be scanned. This can be either a publicly available endpoint or a local repository file.
Required You need to specify the format which is used in the api definition. The available options are "openapi", "soap" or "graphql".
Optional The name of the docker file to be executed. By default the action runs the stable version of ZAP. But you can configure the parameter to use the weekly builds.
Optional Additional command lines options for the full scan script
Optional The title for the GitHub issue to be created.
Optional ZAP action uses the default action token provided by GitHub to create and update the issue for the full scan.
You do not have to create a dedicated token. Make sure to use the GitHub's default action token when running the action(secrets.GIT_TOKEN).
Optional By default ZAP Docker container will fail with an exit code,
if it identifies any alerts. Set this option to true if you want to fail the status of the GitHub Scan if ZAP identifies any alerts during the scan.
-- From this point on, this file is still in WIP stage
** Basic **
steps:
- name: ZAP Scan
uses: zaproxy/[email protected]
with:
target: 'https://www.zaproxy.org/'
** Advanced **
on: [push]
jobs:
zap_scan:
runs-on: ubuntu-latest
name: Scan the webapplication
steps:
- name: Checkout
uses: actions/checkout@v2
with:
ref: master
- name: ZAP Scan
uses: zaproxy/[email protected]
with:
token: ${{ secrets.GITHUB_TOKEN }}
docker_name: 'owasp/zap2docker-stable'
target: 'https://www.zaproxy.org/'
rules_file_name: '.zap/rules.tsv'
cmd_options: '-a'
ZAP is internationalised and alert information is available in many languages.
You can change the language used by this action by changing the locale via the cmd_options e.g.: -z "-config view.locale=fr_FR"
This is currently only available with the owasp/zap2docker-weekly or owasp/zap2docker-live Docker images.
See https://github.com/zaproxy/zaproxy/tree/develop/zap/src/main/dist/lang for the full set of locales currently supported.
You can help improve ZAP translations via https://crowdin.com/project/owasp-zap.