Practical Security Automation and Testing

Case 1 – web security testing using the ZAP REST API

In this case, ZAP will be running in proxy mode with port 8090. Once ZAP is running, the ZAP web console can be reached at http://localhost:8090/UI. The demo website is the target website to be inspected by ZAP. We will use CURL to trigger the ZAP RESTful API to operate ZAP to do spider scans, active scans, review alerts, and shut down ZAP:

ZAP API testing in proxy mode