For now, this is here to help me collect, organize, and articulate my goal and progress on an attempt to integrate a Dockerized [OWASP-ZAP] (https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project) command-line client, into [Jenkins] (https://webqa-ci.mozilla.com/).
I've blogged about the above, here: https://blog.mozilla.org/webqa/2016/06/28/dockerized-owasp-zap-security-scanning-in-jenkins-part-two/
There's also an implicit goal of not unnecessarily duplicating others' work, where possible.
I'm using the following, currently:
Feedback and pull requests are most welcome :-)
Create output directories (optional):
mkdir -p /tmp/report
chmod a+w /tmp/report
mkdir /tmp/session
chmod a+w /tmp/session
Start proxy:
./run-docker.sh -m proxy -i owasp/zap2docker-stable -p 8090 -r /tmp/report -s /tmp/session
Switches -r
and -s
are optional, but without them you will loose session and report files after scanning.
Run your Selenium/REST/whatever integration test using proxy:
File container_ip
contains ip of ZAP's container. You can use it or get IP using docker inspect
.
java -jar my-tests.jar -Dhttp.proxyHost=`cat container_ip` -Dhttp.proxyPort=8090
Start scanner:
./run-docker.sh -m scan http://targetip:8080 http://targetip:9090
Archive report files from directory given by -r
option in Jenkins.