ZAP Automation Framework and Scan Hooks

[A ZAP User]

Hey All,

A bit of context, I am trying to run the template of automation framework in a Docker container but I want to adjust two particular steps:

1. Authentication - I want to override the authentication step so the Spider / Scanners can just use a pre-configured Auth token that I'll hopefully be able to tell ZAP about. This shaves a lot of overhead regarding having to re-authenticate.

2. Kick-off background work when the Proxy is ready - I want to kick off some background requests in order to add some extra site entries to ZAP, but only after the passive scan has started actively listening and before the active scanners start to kick in.

I looked at how I could achieve this and landed on scan hooks but I couldn't see any compatibility of it being mentioned with the automation framework.

Any ideas on how I could achieve this?

[Simon Bennetts]

Hiya,

Scan hooks only work for packaged scans. There are much better options for the Automation Framework.

Re auth, np, see https://www.zaproxy.org/docs/getting-further/authentication/handling-auth-yourself/

Re background work, use the delay job to allow your work to complete: https://www.zaproxy.org/docs/desktop/addons/automation-framework/job-delay/

Cheers,

Simon

[A ZAP User]

Hey Simon,

Thanks for the heads up, that sounds perfect. Will give it a shot.

Cheers,

Dan