repository·main·Indexed 42 days ago
https://github.com/zaproxy/zap-api-pythonA Python client library for interacting with the OWASP ZAP (Zaproxy) API, enabling developers to programmatically manage ZAP and automate security testing. Version 0.6.0 provides modules for controlling active scans, managing add-ons via the autoupdate module, and handling intercepted messages through the brk class.
src/examples directory contains various Python scripts demonstrating how to interact with the ZAP Python API. These scripts serve as practical templates for common automation tasks and API usage patterns.You can install the latest released version of the ZAP Python API using pip. This library provides a Python implementation to access the ZAP API.
pip install zaproxyTo learn how to use the library, you can consult the following resources:
src/examples directory.graphql class provides an interface to interact with ZAP's GraphQL component. Note that this component is optional; the API methods will only function if the GraphQL add-on is installed in your ZAP instance. You access this via the zap.graphql attribute on your main ZAP client instance.The network class provides an interface to manage ZAP's network settings, including proxy configurations (HTTP/SOCKS), certificate management, local servers, and rate limiting.
Note: Many of these features are optional components. If the corresponding ZAP component is not installed, the API calls will fail.
For automated baseline security scanning, you can use the zap-baseline.py script. This script is maintained outside of this specific repository but is a standard way to perform ZAP baseline scans via Python. For detailed operational guidance, refer to the official ZAP Baseline Scan documentation.
https://github.com/zaproxy/zaproxy/blob/main/docker/zap-baseline.pyUse the stats class to access various ZAP statistics. You can retrieve general statistics, site-based statistics, or global statistics. Most methods support an optional keyprefix to filter the results.
# Get general statistics
stats_data = zap.stats.stats(keyprefix='some_prefix')
# Get all site-based statistics
site_stats = zap.stats.all_sites_stats(keyprefix='some_prefix')
# Get statistics for a specific site
site_specific_stats = zap.stats.site_stats(site='http://example.com', keyprefix='some_prefix')The oast class provides an interface for managing Out-of-band Application Security Testing (OAST) services within ZAP. This component is optional; the API methods will only function if the OAST component is installed in your ZAP instance.
Use these properties to retrieve current configurations:
get_active_scan_service: Returns the service currently used with the active scanner.get_services: Returns a list of all available OAST services.get_boast_options: Returns the current BOAST configuration.get_callback_options: Returns the current Callback configuration.get_interactsh_options: Returns the current Interactsh configuration.get_days_to_keep_records: Returns the number of days OAST records are retained.Use these methods to update configurations:
set_active_scan_service(name, apikey=''): Sets the service used by the active scanner.set_boast_options(server, pollinsecs, apikey=''): Configures BOAST with a specific server and pollInSecs interval.set_callback_options(localaddress, remoteaddress, port, apikey=''): Configures Callback settings using localAddress, remoteAddress, and port.set_interactsh_options(server, pollinsecs, authtoken, apikey=''): Configures Interactsh with server, pollInSecs, and an authToken.set_days_to_keep_records(days, apikey=''): Sets the retention period for OAST records in days.from zapv2 import ZAPv2
zap = ZAPv2(apikey='your_api_key')
oast = zap.oast
# Example: Set the active scan service
oast.set_active_scan_service(name='interactsh')
# Example: Get current BOAST options
options = oast.get_boast_options
print(options)Manage request rate limiting to avoid overwhelming target systems:
add_rate_limit_rule(description, enabled, matchregex, matchstring, requestspersecond, groupby, apikey=''): Adds a new rate limit rule.remove_rate_limit_rule(description, apikey=''): Removes a rule by its description.set_rate_limit_rule_enabled(description, enabled, apikey=''): Toggles a rule's enabled state.get_rate_limit_rules: Lists all current rate limit rules.The autoupdate module allows you to install, uninstall, or install local add-on files. Note that install_addon is a synchronous operation and returns when complete.
# Install an add-on by its ID
autoupdate.install_addon(id='addon_id_here', apikey='your_api_key')
# Uninstall an add-on by its ID
autoupdate.uninstall_addon(id='addon_id_here', apikey='your_api_key')
# Install a local add-on file
autoupdate.install_local_addon(file='/path/to/addon.zap', apikey='your_api_key')
# Download the latest ZAP release
autoupdate.download_latest_release(apikey='your_api_key')Use these methods to control how session tokens are handled:
Site-specific tokens:
add_session_token(site, sessiontoken, apikey=''): Adds a token to a specific site.remove_session_token(site, sessiontoken, apikey=''): Removes a token from a specific site.set_session_token_value(site, session, sessiontoken, tokenvalue, apikey=''): Sets the actual value for a specific token within a specific session on a site.Default tokens:
add_default_session_token(sessiontoken, tokenenabled=None, apikey=''): Adds a global default token. tokenenabled can be used to set its initial state.set_default_session_token_enabled(sessiontoken, tokenenabled, apikey=''): Enables or disables a default token.remove_default_session_token(sessiontoken, apikey=''): Removes a default token.# Example: Setting a token value in a session
zap.httpSessions.set_session_token_value(
site='http://example.com',
session='my_session',
sessiontoken='AUTH_TOKEN',
tokenvalue='abc123xyz'
)