How to Install ZAP Add-ons in an Azure Container Deployment

[Satya varaprasad Palathirthapu]

Hi All,

We are deploying OWASP ZAP in an Azure container using a Docker Hub image, with deployment automated via Terraform. ZAP runs fine, but we need guidance on adding custom functionality for our testing, specifically:

• Access control testing add-ons

• Custom payloads that are not part of the built-in Docker image

Our main questions:

1. How can we install custom add-ons or payloads in a containerized ZAP setup?

2. Should these be added during image build or at runtime?

3. How can we persist them across container restarts?

4. Any best practices for managing ZAP profiles and configurations along with custom add-ons?

Any guidance, Terraform examples, or Dockerfile approaches would be greatly appreciated.

Thanks!

[kingthorin+zap]

0) ZAP hasn't been an OWASP project for 2 or 3 years 😉

1) To install or update add-ons see: 

- https://www.zaproxy.org/docs/desktop/cmdline/

- https://www.zaproxy.org/docs/automate/automation-framework/#updating-add-ons

2) For Custom Payloads see:

- https://www.zaproxy.org/faq/how-do-you-find-out-what-key-to-use-to-set-a-config-value-on-the-command-line/

- https://www.zaproxy.org/docs/desktop/cmdline/

- https://www.zaproxy.org/docs/desktop/addons/automation-framework/environment/#configs

- https://www.zaproxy.org/docs/desktop/addons/custom-payloads/api/