OWASP ZAP Full Scan Authenticated on Gitlab CICD

Question

I want to do a zap full scan on gitlab cicd with authentication to the website i want to run it (without the DAST module from gitlab)

i can run the zap-full-scan.py properly but dont know how to add authentication credentials for the site

stages:
  - scan
dast: 
  stage: scan
  image:
    name: owasp/zap2docker-weekly
  before_script:
    - mkdir -p /zap/wrk
  script:
    - pwd
    - ls
    - zap-full-scan.py -t "http://example.com" -m 1 -d -I -r testreport.html 
    - cp /zap/wrk/testreport.html testreport.html
  artifacts:
    when: always
    paths:
      - testreport.html

Answer 1

using this modified version https://github.com/ICTU/zap2docker-auth-weekly

stages:
- scan
dast: 
  stage: scan
  image:
    name: ictu/zap2docker-weekly 
  before_script:
    - mkdir -p /zap/wrk
  script:
    - pwd
    - ls
    - zap-full-scan.py -t "http://testphp.vulnweb.com" -I -r testreport.html --hook=/zap/auth_hook.py -z "auth.loginurl=http://example.com/login.php auth.username_field="uname" auth.password_field="pass" auth.username="username" auth.password="pass""
    - cp /zap/wrk/testreport.html testreport.html
  artifacts:
    when: always
    paths:
      - testreport.html

Answer 2

Run ZAP locally and get authentication working as per https://www.zaproxy.org/docs/authentication/

Then export your context file and specify that and the user you want to use as per https://www.zaproxy.org/docs/docker/full-scan/

Answer 3

It's also possible to authenticate the user before performing DAST checks:

dast:
  image: registry.gitlab.com/gitlab-org/security-products/zaproxy
  variables:
    website: "https://example.com"
    login_url: "https://example.com/sign-in"
  script:
    - mkdir /zap/wrk/
    - /zap/zap-baseline.py -J gl-dast-report.json -t $website \
        --auth-url $login_url \
        --auth-username "john.doe@example.com" \
        --auth-password "john-doe-password" || true
    - cp /zap/wrk/gl-dast-report.json .
  artifacts:
    paths: [gl-dast-report.json]

See zaproxy documentation to learn more about authentication settings.