Purpose
Use this skill for OWASP Top 10-oriented web and API testing when the engagement needs a proxy, baseline scanner, or repeatable web validation workflow.
Phase Fit
- Primary: Vulnerability Analysis
- Secondary: Validation and Controlled Impact Demonstration, Retest and Closure
Use When
- Need baseline web scanning aligned to common OWASP categories.
- Need proxy-based request inspection or replay.
- Need repeatable web retests after remediation.
Avoid When
- Target workflows are highly stateful and require more manual control than the chosen scan mode provides.
- Automated scanning would exceed the approved impact level.
Inputs
- Approved web target or API base URL
- Auth context, scan depth, and exclusions
- Output and evidence requirements
Procedure
- Start with passive or baseline analysis before active checks.
- Scope scanning to the approved application areas.
- Manually validate material findings before escalation.
- Record the exact scan profile and exclusions used.
- Preserve the scan path for retest.
Command Syntax
Replace sample targets with approved in-scope URLs.
# Passive baseline scan via Docker
docker run -t owasp/zap2docker-stable zap-baseline.py -t https://portal.contoso.com -r contoso-zap-report.html
# Full active scan via Docker
docker run -t owasp/zap2docker-stable zap-full-scan.py -t https://portal.contoso.com -r contoso-full.html
# API scan against OpenAPI spec
docker run -t owasp/zap2docker-stable zap-api-scan.py -t https://api.contoso.com/openapi.json -f openapi -r contoso-api.html
# Start ZAP as daemon (local install)
zaproxy -daemon -host 127.0.0.1 -port 8080
# Quick URL scan from CLI
zaproxy -cmd -quickurl https://portal.contoso.com -quickout contoso-zap.html
Evidence to Capture
- Confirmed web findings relevant to OWASP categories
- Exact target, auth context, and scan profile used
- Minimal reproduction path for retest
Safety Boundaries
- Start passive and keep active checks within approved scope.
- Treat scanner output as triage input until manually confirmed.