Summary

In this chapter, we used an online shopping platform to perform web security testing using ZAP. Two main approaches were introduced. The first was using ZAP for web security scanning, which was automated by a REST API or CLI. The other approach was the integration of ZAP and Selenium to review security issues during the user registration flow. Let's review the key learning objectives of each case.

The purpose of case 1 was to demonstrate how to automate the ZAP spider scan by using a REST API and CURL.

The objective of case 2 was to run ZAP in daemon mode and to execute a full security scan cycle in one script. The automation steps of ZAP scanning include the following:

1. Launch ZAP in daemon mode
2. Spider scan the whole website
3. Active scan all the scanned URLs
4. Check status and wait for the active scan to finish
5. Shut down the ZAP daemon

Case 3 looked at automated security...