Security Testing with ZAP and GitHub Actions

#github #devsecops #githubactions #owasp

Dynamic Application Security Testing (DAST) with OWASP Zap Scanner

PREREQUISITE

GitHub Account
Sample Website (https://techconnectweb.azurewebsites.net/). This Demo only for Education Purpose. Try at your own risk.

For this demo, I decided to use OWASP ZAP Full Scan.
You can find this at GitHub Marketplace.

Let Start the Demo

Go to Actions tab at your GitHub Repo.
Select set up a workflow yourself ->
Go to Marketplace, search for OWASP and Select OWASP ZAP Full Scan, and you will see the sample workflow snippet.
Modify the workflow snippet as below and replace with sample website URL. After modified, select Start commit. ```

name: zapfull-security-scan
on:
push:
branches: [ master ]
pull_request:
branches: [ master ]

jobs:
build:
runs-on: ubuntu-latest
steps:

- name: OWASP ZAP Full Scan
uses: zaproxy/action-full-scan@v0.1.0
with:
target: "https://techconnectweb.azurewebsites.net/"

5.Go back to **Actions** tab, you will see the workflow In progress.
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/wllu15r7m5dsxzdqt2l0.png)
6.Select the **build**. The workflow in progress setup and scanning.
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/4oiiguov4c43n40j4vqg.png)
7.After complete scanning through OWASP ZAP, the report will generated in **Issues** tab.
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/1wucdpskc91iwypvby1u.png)
8.For more details for OWASP ZAP Full Scan report, you can go back to the **Actions** tab, select the Artifacts **zap_scan**. After downloaded, you will see the OWASP Report as below.
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/vlwmjganc8zfg46ljabp.png)

References:
https://www.zaproxy.org/blog/2020-05-15-dynamic-application-security-testing-with-zap-and-github-actions/

DEV Community

Security Testing with ZAP and GitHub Actions

Top comments (0)

Read next

I watched "So You Think You Know Git" so you don't have to

🚀 How to Generate and Add SSH Keys to GitHub or Bitbucket (MacOS Guide)

Deep Dive Into Git(Part II)

How to Set Up SSH Keys for GitHub on PopOs or Ubuntu: A Beginner's Guide