Learn
LoginRegister
← All tools

ZAP Automation Framework

Tool manual · Kali & common usage

Web testing · Intermediate · Web testing lane

IntermediateDAST
Authorized usage only. Capture and inspect traffic only on systems and networks you own or have written permission to analyze.

What is ZAP Automation Framework?

ZAP Automation Framework runs OWASP ZAP scans from YAML plans in CI.

Repeatable DAST against staging apps you own.

Official website: ZAP Automation Framework · Documentation

When do you use it?

  • You need Automate OWASP ZAP scans in CI.
  • You are following a CYNARKS lab or authorized engagement that calls for ZAP Automation Framework.
  • You already tried simpler checks and need this tool’s deeper capability.

Who uses it?

  • AppSec engineers
  • Bug bounty hunters (in-scope)
  • Penetration testers

How do you use it? (typical flow)

  1. Install ZAP Automation Framework using the steps below (prefer Kali package or official installer).
  2. Confirm you have authorization for the target (lab VM, own system, or written scope).
  3. Run --help / man (or the Help section) to see current flags for your version.
  4. Start with a safe example from Basic commands against localhost or an authorized lab target.
  5. Record what you ran, what you observed, and any follow-up (filter, report, remediation).

Help & manual (like man / --help)

Every serious tool has a built-in way to look up flags. Learn these first so you are not stuck memorizing every option.

  1. 1. Docs

    https://www.zaproxy.org/docs/automate/

Kali Linux

Use zaproxy/zap-stable Docker with automation plans.

1. Installation

OSInstallation
Kali LinuxUse zaproxy/zap-stable Docker with automation plans.
Dockerzaproxy/zap-stable

2. Basic commands

  1. 1. Run automation plan against localhost

    zap.sh -cmd -autorun plan.yaml

    Run automation plan against localhost

  2. 2. Show help

    zap.sh --help

    List flags for your installed version (same habit as man/--help).

  3. 3. Short help

    zap.sh -h

    Alternate help flag when supported.

5. Useful features

  • Automation plans
  • API

6. Practical examples

  1. Example 1: Run automation plan against localhost

    zap.sh -cmd -autorun plan.yaml

    Run automation plan against localhost

  2. Example 2: Show help

    zap.sh --help

    List flags for your installed version (same habit as man/--help).

  3. Example 3: Short help

    zap.sh -h

    Alternate help flag when supported.

7. Important notes

  • DAST in pipeline — scope to owned apps.
  • Authorized targets only — labs, systems you own, or written permission.
  • Prefer reading --help / man / official docs for your installed version; flags change over time.

Related course: web application security · bug bounty hunting · Commands: /commands#burp