Run a active scan from OWASP ZAP through Ubuntu command line using Open API Definition

Question

I'm trying to run a active scan from OWASP ZAP using only my Ubuntu(22.04) terminal by importing a external open API definition. This can be easily done through the GUI, but I need to do the same process using only command line. I didn't found a proper documentation to follow either.

I have tried following structure of the command to do the active scan, but seems it fails.

/path/to/zap.sh -daemon -openapifile /path/to/swagger.json  -openapitargeturl /path/to/targetUrl -quickout /path/to/output.html

Can anyone suggest a proper way to make this active scan through the Ubuntu terminal.

Answer 1

We have lots of documentation for automating ZAP - see https://www.zaproxy.org/docs/automate/ I recommend looking at the API packaged scan and the Automation Framework.