Practical Security Automation and Testing

Step 3 – execute the testing under ZAP-CLI

Once ZAP and the ZAP-CLI setup are done, we may trigger a few security assessments. Please be reminded that a spider scan is a must before running an active scan. Here are the differences between spider, quick, and active scans:

• Spider Scan: It will explore and search all possible resources and URLs of the website. No security attacks will be performed.
• Active Scan: It will do security checks based on URLs or web resources available in the ZAP site tree. Therefore, a spider scan to explore web resources is a must before an active scan.
• Quick Scan: It's an all-in-one command that can do a spider scan, active scan and generate a testing report.

To trigger the security scanning with the ZAP-CLI, execute ...