Free readiness test
Home / Tool labs / OWASP ZAP

OWASP ZAP hands-on lab Baseline the staging shop

Test web applications for security issues, automatically, in your pipeline.

Application SecurityIntermediatePro live lab4 objectives
appsec@ci:~/shop$
$ docker run -v $(pwd):/zap/wrk -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py -t https://staging.shop.lab -r report.html
Total of 41 URLs
FAIL-NEW: 0   WARN-NEW: 5   INFO: 3   PASS: 58
Report written to report.html  (share with the dev team and attach to the release ticket)

What is OWASP ZAP?

ZAP (Zed Attack Proxy) is a widely used open-source web application scanner. The baseline scan passively checks responses for issues, which makes it safe to run against staging on every deploy.

1 Passive vs active

Baseline (passive) only inspects responses; active scans send attack payloads and must only target systems you're authorised to test.

2 Alerts & risk

Findings are grouped as High/Medium/Low/Informational with CWE references.

3 Automation

Docker-packaged scripts (zap-baseline.py, zap-api-scan.py) fit straight into CI.

The scenario: Baseline the staging shop

Your team owns https://staging.shop.lab. Before go-live, run a passive ZAP baseline scan, generate the HTML report, scan the API from its OpenAPI spec, then verify the headers fix.

Run this lab live in the platform

A simulated terminal with 4 objectives, hints and scenario questions. Included with NERvE Pro.

Open the OWASP ZAP lab

Step-by-step: OWASP ZAP commands used in this lab

1Run the ZAP baseline scan against staging

zap-baseline.py -t <url> via the ZAP Docker image.

docker run -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py -t https://staging.shop.lab

2Generate an HTML report

Add -r report.html

docker run -v $(pwd):/zap/wrk -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py -t https://staging.shop.lab -r report.html

3Scan the API using its OpenAPI definition

zap-api-scan.py with -f openapi

docker run -t ghcr.io/zaproxy/zaproxy:stable zap-api-scan.py -t https://staging.shop.lab/openapi.json -f openapi

4Verify the security headers after the fix

curl -sI to view response headers.

curl -sI https://staging.shop.lab

Key takeaways

Install OWASP ZAP and practise for real

docker pull ghcr.io/zaproxy/zaproxy:stable

Practise against OWASP Juice Shop running locally (docker run -p 3000:3000 bkimminich/juice-shop). Only scan or test systems you own or are explicitly authorised to assess. Official site: www.zaproxy.org · Licence: Apache 2.0.

Scenario questions

Why is the baseline scan safe for every deploy?

Answer: It's passive: it inspects responses without sending attacks. Passive scanning doesn't modify data or send exploit payloads.

Which header protects against clickjacking?

Answer: CSP frame-ancestors (or X-Frame-Options). frame-ancestors 'none' stops other sites from framing your pages.

What's wrong with returning stack traces?

Answer: They reveal internals (frameworks, queries, paths) that help attackers. Show users a generic message; log details privately.

More open-source tool labs

📡

Nmap

Discover hosts, open ports and services on networks you're authorised to assess.

🦈

Wireshark / tshark

See exactly what's crossing the wire and spot malware calling home.

🔭

Zeek

Turn raw traffic into rich, searchable logs for threat hunting.

🚨

Suricata

Detect attacks in network traffic with signatures, and write your own.

🛡️

Wazuh

An open-source SIEM and XDR: collect logs, detect attacks, respond automatically.

Σ

Sigma

Write a detection once, run it in any SIEM.