Security Testing with OWASP ZAP in CI/CD
summary
OWASP ZAP is presented as a free tool with ~350,000 downloads that embeds into CI/CD to automate security checks; it runs a safe, fast Baseline scan that one‑minute spiders and passive‑scans for headers/cookies/CSRF, offers longer active scans for XSS/SQLi, ships official Docker images (stable/weekly/live) for pipeline use, exposes a full REST‑ish API to drive spiders, scans and reports, and integrates with a Jenkins plugin and Mozilla Cloud Services; a mass baseline dashboard raises issues and the setup is used in production.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 7:26Features
- 11:19Use Cases
- 13:45Getting Started
- 17:49Mass Baseline Scan
- 21:12Quick Scan
- 24:25Questions
- 24:58API
- 26:04Demo
- 28:26Tips
- 29:24Python API
- 29:55Exploring
- 31:56ZAP Spider
- 34:43AJAX Spider
- 36:32Authentication
- 37:00Speed
- 37:27Feedback
- 37:47Help
- 38:14QA
related talks
36mLet's take baby steps to security testing
33mAutomated Security Scanning in Payment Card Industry
01h 01mOpen Source Pentesting and Security Analysis Tools: the DevOps way… #slideless
35mAutomated Security Testing
45mAutomated Security Testing in a DevOps world
40mEvolution of AppSec: Perspectives from a Decade of Building OWASP ZAP
42mTest Driven Security in the DevOps pipeline
47mAutomated Security Scanning in Payment Industry