Security Automation with Ansible 2

Testing web APIs

Similar to the ZAP Baseline scan, the fine folks behind ZAP provide a script as part of their live and weekly Docker images. We can use it to run scans against API endpoints defined either by OpenAPI specification or Simple Object Access Protocol (SOAP).

The script can understand the API specifications and import all the definitions. Based on this, it runs an active scan against all the URLs found:

- name: Running OWASP ZAP API Scan  hosts: zap  remote_user: "{{ remote_user_name }}"  gather_facts: no  become: yes  vars:    remote_user_name: ubuntu    owasp_zap_image_name: owasp/zap2docker-weekly    website_url: {{ website_url }}    reports_location: /zapdata/    scan_name: owasp-zap-api-scan-dvws    api_type: openapi>  tasks:    - name: adding write ...