OWASP ZAP: Active Scanner in Continuos Integration
<p>Trying to use ZAP (2.4.3) in a continuos integration (CI) setting. I can run ZAP as a daemon, run all my Selenium tests (in Java) by using ZAP as a proxy, and then being able to use the REST api calling <code>htmlreport</code> to get a final report of the Passive Scanner. This works fine, but I would like to also use the Active Scanner.</p>

<p>Using the Active Scanner in CI is mentioned several times in ZAP's documentation, but haven't found any working example or tutorial about it... does any exist?</p>

<p>What I would like to achieve is something like: <em>Run Active Scanner on all the pages visited by the Selenium regression suite, once it is finished to run.</em></p>

<p>Trying to look at ZAP's REST api, but is mostly undocumented:</p>

<p><a href="https://github.com/zaproxy/zaproxy/wiki/ApiGen_Index" rel="nofollow">https://github.com/zaproxy/zaproxy/wiki/ApiGen_Index</a></p>

<p>Ideally, it would be great to have something like:</p>

<ul>
<li>Start Active Scan asynchronously on all visited urls </li>
<li>Poll to check if Active Scan run is completed</li>
</ul>

<p>In the REST api it seems there is something related, but:</p>

<ul>
<li><code>ascan/scan</code> needs an url as input. Could call <code>core/urls</code> to see what the Selenium tests have visited, but then how to set the right authentication (logging credential)? What if the order in which the urls are visited is important? What if a page is only accessable with a specific credential? </li>
<li>there is an <code>ascan/scanAsUser</code>, but it is unclear how <code>contextId</code> and <code>userId</code> can be retrieved from ZAP. A cumbersome workaround would be to modify the Selenium tests to write on disk the urls they visit and which logging/password credentials they are using, and then, once all tests are finished, to read from disk such info to call ZAP. Is there any simpler way?      </li>
</ul>