Security Automation with Ansible 2

Configuring ZAP Baseline scan

The ZAP Baseline scan is a script that is available in the ZAP Docker images. 

 More details about OWASP ZAP Baseline scan can be found at https://github.com/zaproxy/zaproxy/wiki/ZAP-Baseline-Scan.

This is what the script does:

• Runs ZAP spider against the specified target for one minute and then does a passive scan
• By default, reports all alerts as warnings 
• This script is intended to be ideal to run in a CI/CD environment, even against production sites

Before setting up and running the ZAP Baseline scan, we want to run a simple vulnerable application so that all scans and testing using ZAP are running against that application, rather than running the scans against real-world applications, which is illegal ...