testland/zap-baseline
Configures and runs OWASP ZAP baseline scanning: `zap-baseline.py` Docker-packaged spider + passive scan suitable for CI gating; supports `-t target_url` + `-r html_report` + `-c config_file` rule customization (INFO/IGNORE/FAIL warnings) and Ajax spider via `-j` for JS-heavy SPAs; `zap-full-scan.py` active companion for staging. Covers authenticated scans end to end as a reference - ZAP Context, auth methods (form/JSON/script/browser), session management, verification strategy, OAuth/bearer injection, context XML export for `-n` - plus DAST cadence planning (PR-blocking passive baseline, nightly ZAP full + nuclei active layer, baseline-finding ratchet for legacy apps). Use when the user runs OWASP ZAP for pre-prod web app DAST, needs coverage of routes behind a login wall, or is designing a team's DAST rollout cadence.
73
92%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
verification-strategy.mdreferences/
ZAP Authentication Verification Strategy
Per zap-verify, ZAP uses an Authentication Verification Strategy to know
whether a request is executing as an authenticated user. Configure in
Session Properties > Context > Authentication > Verification:
Logged-In Indicator: a regex present in responses when the user is authenticated. Examples:
\QWelcome, \E(welcome banner with the username)\Qhref="/logout"\E(logout link in nav)\Q"role":"user"\E(JSON response field)
Logged-Out Indicator: a regex present in responses when the session has expired. Examples:
\QPlease log in\E\Qlocation: /login\E(redirect header)HTTP/1\.1 401
Per zap-verify, four strategies are available:
| Strategy | Use when |
|---|---|
| Check Every Response | Traditional HTML apps (indicator in page body) |
| Check Every Request | Client-side sessions (JWT in Authorization header) |
| Check Every Request or Response | Mixed; SPA + API combo |
| Poll the Specified URL | Dedicated /api/me or /session/check endpoint |
Calibration steps:
- Browse the app manually through ZAP proxy while logged in.
- Right-click a response in the History tab that contains the logged-in
text. Choose
Flag as Context > <context-name> Logged in indicator. ZAP extracts the regex automatically. - Browse to a page after logging out. Right-click that response. Choose
Flag as Context > <context-name> Logged out indicator. - Confirm both indicators in
Session Properties > Context > Authentication.