[英]OWASP ZAP Full Scan Authenticated on Gitlab CICD
I want to do a zap full scan on gitlab cicd with authentication to the website i want to run it (without the DAST module from gitlab)我想对 gitlab cicd 进行 zap 全面扫描,并对我要运行它的网站进行身份验证(没有来自 gitlab 的 DAST 模块)
i can run the zap-full-scan.py properly but dont know how to add authentication credentials for the site我可以正确运行 zap-full-scan.py 但不知道如何为站点添加身份验证凭据
stages:
- scan
dast:
stage: scan
image:
name: owasp/zap2docker-weekly
before_script:
- mkdir -p /zap/wrk
script:
- pwd
- ls
- zap-full-scan.py -t "http://example.com" -m 1 -d -I -r testreport.html
- cp /zap/wrk/testreport.html testreport.html
artifacts:
when: always
paths:
- testreport.html
using this modified version https://github.com/ICTU/zap2docker-auth-weekly使用这个修改后的版本https://github.com/ICTU/zap2docker-auth-weekly
stages:
- scan
dast:
stage: scan
image:
name: ictu/zap2docker-weekly
before_script:
- mkdir -p /zap/wrk
script:
- pwd
- ls
- zap-full-scan.py -t "http://testphp.vulnweb.com" -I -r testreport.html --hook=/zap/auth_hook.py -z "auth.loginurl=http://example.com/login.php auth.username_field="uname" auth.password_field="pass" auth.username="username" auth.password="pass""
- cp /zap/wrk/testreport.html testreport.html
artifacts:
when: always
paths:
- testreport.html
Run ZAP locally and get authentication working as per https://www.zaproxy.org/docs/authentication/在本地运行 ZAP 并按照https://www.zaproxy.org/docs/authentication/进行身份验证
Then export your context file and specify that and the user you want to use as per https://www.zaproxy.org/docs/docker/full-scan/然后导出您的上下文文件并根据https://www.zaproxy.org/docs/docker/full-scan/指定该文件以及您要使用的用户
It's also possible to authenticate the user before performing DAST checks:也可以在执行 DAST 检查之前对用户进行身份验证:
dast:
image: registry.gitlab.com/gitlab-org/security-products/zaproxy
variables:
website: "https://example.com"
login_url: "https://example.com/sign-in"
script:
- mkdir /zap/wrk/
- /zap/zap-baseline.py -J gl-dast-report.json -t $website \
--auth-url $login_url \
--auth-username "john.doe@example.com" \
--auth-password "john-doe-password" || true
- cp /zap/wrk/gl-dast-report.json .
artifacts:
paths: [gl-dast-report.json]
See zaproxy documentation to learn more about authentication settings.请参阅zaproxy 文档以了解有关身份验证设置的更多信息。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.