# Owasp Zap

> Use for OWASP-focused web and API testing during authorized pentests. Trigger on proxy-based web review, automated or manual scan support, baseline OWASP Top 10 coverage, and validating application security controls with a lighter-weight interception workflow.

- Skill: `timsonner/owasp-zap` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/owasp-zap`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/owasp-zap/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/owasp-zap

---


# OWASP ZAP

## Purpose

Use this skill for OWASP Top 10-oriented web and API testing when the engagement needs a proxy, baseline scanner, or repeatable web validation workflow.

## Phase Fit

- Primary: Vulnerability Analysis
- Secondary: Validation and Controlled Impact Demonstration, Retest and Closure

## Use When

- Need baseline web scanning aligned to common OWASP categories.
- Need proxy-based request inspection or replay.
- Need repeatable web retests after remediation.

## Avoid When

- Target workflows are highly stateful and require more manual control than the chosen scan mode provides.
- Automated scanning would exceed the approved impact level.

## Inputs

- Approved web target or API base URL
- Auth context, scan depth, and exclusions
- Output and evidence requirements

## Procedure

1. Start with passive or baseline analysis before active checks.
2. Scope scanning to the approved application areas.
3. Manually validate material findings before escalation.
4. Record the exact scan profile and exclusions used.
5. Preserve the scan path for retest.

## Command Syntax

Replace sample targets with approved in-scope URLs.

```bash
# Passive baseline scan via Docker
docker run -t owasp/zap2docker-stable zap-baseline.py -t https://portal.contoso.com -r contoso-zap-report.html

# Full active scan via Docker
docker run -t owasp/zap2docker-stable zap-full-scan.py -t https://portal.contoso.com -r contoso-full.html

# API scan against OpenAPI spec
docker run -t owasp/zap2docker-stable zap-api-scan.py -t https://api.contoso.com/openapi.json -f openapi -r contoso-api.html

# Start ZAP as daemon (local install)
zaproxy -daemon -host 127.0.0.1 -port 8080

# Quick URL scan from CLI
zaproxy -cmd -quickurl https://portal.contoso.com -quickout contoso-zap.html
```

## Evidence to Capture

- Confirmed web findings relevant to OWASP categories
- Exact target, auth context, and scan profile used
- Minimal reproduction path for retest

## Safety Boundaries

- Start passive and keep active checks within approved scope.
- Treat scanner output as triage input until manually confirmed.