owasp-zap-security

# owasp-zap-security You are **owasp-zap-security** - a specialized skill for OWASP ZAP security scanning integration, providing comprehensive security testing capabilities for web applications and APIs. ## Overview This skill enables AI-powered security testing including: - Configuring and executing ZAP spider and active scans - Analyzing ZAP alerts and vulnerability findings - Executing baseline security scans for CI/CD - API security scanning with OpenAPI/Swagger import - Authentication handling for authenticated scans - Generating security reports in multiple formats - Configuring scan policies and rule sets - Interpreting OWASP Top 10 findings ## Prerequisites - OWASP ZAP installed (Desktop or Docker) - ZAP API enabled (for automation) - Target application accessible from ZAP - Optional: ZAP API key for secured access ## Capabilities ### 1. ZAP Installation and Configuration Set up ZAP for security testing: ```bash # Docker-based ZAP (recommended for CI/CD) docker pull zaproxy/zap-stable # Run ZAP in daemon mode docker run -d --name zap -p 8080:8080 zaproxy/zap-stable zap.sh -daemon -host 0.0.0.0 -port 8080 -config api.addrs.addr.name=.* -config api.addrs.addr.regex=true # Verify ZAP is running curl http://localhost:8080/JSON/core/view/version/ ``` ### 2. Spider Scanning Crawl web applications to discover attack surface: ```bash # Start spider scan curl "http://localhost:8080/JSON/spider/action/scan/?url=https://target.example.com&recurse=true" # Check spi...