OWASP ZAP Home Lab Setup

OWASP ZAP Home Lab

OWASP ZAP Home Lab Security Scanner Automated Scanning API Testing CI/CD Vulnerability Analysis OWASP Top 10 SQL Injection XSS CSRF Production

Lab Setup with Docker

# === Docker Compose Home Lab ===

# docker-compose.yml
# version: '3.8'
# services:
#   zap:
#     image: owasp/zap2docker-stable
#     ports:
#       - "8080:8080"
#       - "8090:8090"
#     command: zap-webswing.sh
#     networks:
#       - security-lab
#
#   dvwa:
#     image: vulnerables/web-dvwa
#     ports:
#       - "8081:80"
#     environment:
#       MYSQL_DATABASE: dvwa
#     networks:
#       - security-lab
#
#   juice-shop:
#     image: bkimminich/juice-shop
#     ports:
#       - "3000:3000"
#     networks:
#       - security-lab
#
#   webgoat:
#     image: webgoat/webgoat
#     ports:
#       - "8082:8080"
#     networks:
#       - security-lab
#
# networks:
#   security-lab:
#     driver: bridge

# Start lab
# docker-compose up -d

# ZAP CLI Quick Scan
# docker run -t owasp/zap2docker-stable zap-baseline.py \
#   -t http://dvwa:80 \
#   -r report.html

# ZAP Full Scan
# docker run -t owasp/zap2docker-stable zap-full-scan.py \
#   -t http://juice-shop:3000 \
#   -r full-report.html \
#   -J full-report.json

# ZAP API Scan
# docker run -t owasp/zap2docker-stable zap-api-scan.py \
#   -t http://api-server:8000/openapi.json \
#   -f openapi \
#   -r api-report.html

from dataclasses import dataclass

@dataclass
class LabTarget:
    name: str
    image: str
    port: int
    purpose: str
    difficulty: str

targets = [
    LabTarget("DVWA", "vulnerables/web-dvwa", 8081,
        "Classic vulnerable web app, adjustable difficulty", "Beginner"),
    LabTarget("Juice Shop", "bkimminich/juice-shop", 3000,
        "Modern OWASP Top 10, CTF challenges", "Beginner-Advanced"),
    LabTarget("WebGoat", "webgoat/webgoat", 8082,
        "Tutorial-style vulnerability learning", "Beginner"),
    LabTarget("Mutillidae", "citizenstig/nowasp", 8083,
        "OWASP Top 10 practice", "Intermediate"),
    LabTarget("HackTheBox", "Custom VMs", 0,
        "Real-world CTF challenges", "Advanced"),
]

print("=== Lab Targets ===")
for t in targets:
    print(f"  [{t.name}] Image: {t.image} | Port: {t.port}")
    print(f"    Purpose: {t.purpose}")
    print(f"    Difficulty: {t.difficulty}")

Automated Scanning

# === ZAP Automation Framework ===

# automation.yaml
# env:
#   contexts:
#     - name: "My App"
#       urls: ["http://target:8080"]
#       authentication:
#         method: "form"
#         parameters:
#           loginUrl: "http://target:8080/login"
#           loginRequestData: "username={%username%}&password={%password%}"
#         verification:
#           method: "response"
#           loggedInRegex: "\\QWelcome\\E"
#       users:
#         - name: "test-user"
#           credentials:
#             username: "admin"
#             password: "password"
#
# jobs:
#   - type: spider
#     parameters:
#       context: "My App"
#       user: "test-user"
#       maxDuration: 5
#   - type: spiderAjax
#     parameters:
#       context: "My App"
#       maxDuration: 5
#   - type: passiveScan-wait
#     parameters:
#       maxDuration: 10
#   - type: activeScan
#     parameters:
#       context: "My App"
#       user: "test-user"
#       maxDuration: 30
#   - type: report
#     parameters:
#       template: "traditional-html"
#       reportDir: "/zap/reports/"
#       reportFile: "scan-report"

# Run automation
# docker run -v $(pwd):/zap/wrk/:rw \
#   owasp/zap2docker-stable \
#   zap.sh -cmd -autorun /zap/wrk/automation.yaml

@dataclass
class VulnFinding:
    risk: str
    name: str
    cwe: str
    count: int
    action: str

findings = [
    VulnFinding("High", "SQL Injection", "CWE-89", 3,
        "Use parameterized queries, input validation"),
    VulnFinding("High", "Cross-Site Scripting (XSS)", "CWE-79", 5,
        "Output encoding, Content Security Policy"),
    VulnFinding("Medium", "Missing Security Headers", "CWE-693", 8,
        "Add X-Frame-Options, CSP, HSTS headers"),
    VulnFinding("Medium", "CSRF Token Missing", "CWE-352", 2,
        "Implement anti-CSRF tokens"),
    VulnFinding("Low", "Cookie without HttpOnly", "CWE-1004", 4,
        "Set HttpOnly flag on session cookies"),
    VulnFinding("Info", "Server Information Disclosure", "CWE-200", 1,
        "Remove server version headers"),
]

print("\n=== Scan Findings ===")
for f in findings:
    print(f"  [{f.risk}] {f.name} (CWE: {f.cwe}) — {f.count} instances")
    print(f"    Action: {f.action}")

CI/CD Integration

# === GitHub Actions ZAP Scan ===

# .github/workflows/zap-scan.yml
# name: OWASP ZAP Security Scan
# on:
#   pull_request:
#     branches: [main]
#   schedule:
#     - cron: '0 2 * * *'  # Nightly full scan
#
# jobs:
#   baseline-scan:
#     if: github.event_name == 'pull_request'
#     runs-on: ubuntu-latest
#     steps:
#       - uses: actions/checkout@v4
#       - name: Start application
#         run: docker-compose up -d app
#       - name: ZAP Baseline Scan
#         uses: zaproxy/action-baseline@v0.10.0
#         with:
#           target: 'http://localhost:8080'
#           rules_file_name: '.zap/rules.tsv'
#           fail_action: 'true'
#       - uses: actions/upload-artifact@v4
#         with:
#           name: zap-baseline-report
#           path: report_html.html
#
#   full-scan:
#     if: github.event_name == 'schedule'
#     runs-on: ubuntu-latest
#     steps:
#       - uses: actions/checkout@v4
#       - name: Start application
#         run: docker-compose up -d app
#       - name: ZAP Full Scan
#         uses: zaproxy/action-full-scan@v0.9.0
#         with:
#           target: 'http://localhost:8080'
#           rules_file_name: '.zap/rules.tsv'
#       - name: Send to Slack
#         if: failure()
#         uses: slackapi/slack-github-action@v1
#         with:
#           payload: '{"text": "ZAP Full Scan found vulnerabilities!"}'

# .zap/rules.tsv — Custom policy
# 10016	IGNORE	(Web Browser XSS Protection Not Enabled)
# 10017	IGNORE	(Cross-Domain JavaScript Source File Inclusion)
# 10021	WARN	(X-Content-Type-Options Header Missing)
# 40012	FAIL	(Cross Site Scripting - Reflected)
# 40014	FAIL	(Cross Site Scripting - Persistent)
# 40018	FAIL	(SQL Injection)

@dataclass
class CIPolicy:
    risk: str
    pr_action: str
    nightly_action: str
    sla: str

policies = [
    CIPolicy("Critical", "Block merge", "Alert on-call + create P1 ticket", "Fix within 24 hours"),
    CIPolicy("High", "Block merge", "Alert team + create P2 ticket", "Fix within 1 week"),
    CIPolicy("Medium", "Warning comment", "Create P3 ticket", "Fix within 1 month"),
    CIPolicy("Low", "Info only", "Log to dashboard", "Fix in next quarter"),
    CIPolicy("Info", "Ignore", "Log to dashboard", "Best effort"),
]

print("CI/CD Security Policy:")
for p in policies:
    print(f"  [{p.risk}] PR: {p.pr_action} | Nightly: {p.nightly_action}")
    print(f"    SLA: {p.sla}")

เคล็ดลับ

• Baseline: เริ่มด้วย Baseline Scan ทุก PR เร็วและไม่ Intrusive
• Isolated: รัน Lab ใน Docker Network แยก ไม่ Scan ระบบอื่น
• Auth: ตั้ง Authentication Context สำหรับ Scan หลัง Login
• Policy: กำหนด Rules ว่า Finding ไหน FAIL ไหน WARN ไหน IGNORE
• Legal: Scan เฉพาะระบบที่ได้รับอนุญาต ไม่ Scan ระบบคนอื่น

OWASP ZAP คืออะไร

Open Source Security Scanner OWASP Active Passive Spider Fuzzer SQL Injection XSS CSRF OWASP Top 10 GUI CLI API CI/CD ฟรี

สรุป

OWASP ZAP Home Lab Docker DVWA Juice Shop Automated Scanning Baseline Full API CI/CD GitHub Actions Policy Vulnerability OWASP Top 10 Production Security