mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-08-06 19:00:17 +03:00
mukul975
27c6414ca5
Complete skill folder anatomy across all cybersecurity skills: - scripts/agent.py: 80-150 line Python agents using real libraries (impacket, boto3, azure-mgmt-*, kubernetes, pefile, yara, scapy, shodan, stix2, etc.) - references/api-reference.md: real API documentation with method signatures - LICENSE: MIT license for all skill folders
1.5 KiB
1.5 KiB
API Reference: OWASP ZAP DAST Pipeline Integration
ZAP Docker Scan Scripts
Baseline Scan (Passive Only)
docker run --rm -v $(pwd):/zap/wrk zaproxy/zap-stable \
zap-baseline.py -t https://target.com -J report.json -I
Full Scan (Active + Passive)
docker run --rm -v $(pwd):/zap/wrk zaproxy/zap-stable \
zap-full-scan.py -t https://target.com -J report.json -m 5 -I
API Scan (OpenAPI/Swagger)
docker run --rm -v $(pwd):/zap/wrk zaproxy/zap-stable \
zap-api-scan.py -t https://target.com/openapi.json -f openapi -J report.json
Return Codes
| Code | Meaning |
|---|---|
| 0 | No alerts above threshold |
| 1 | Warnings found |
| 2 | Failures found |
Common Flags
| Flag | Description |
|---|---|
-t |
Target URL |
-J |
JSON report filename |
-m |
Max scan duration in minutes |
-I |
Do not return failure on warnings |
-f |
API spec format (openapi, soap) |
-r |
HTML report filename |
-c |
Config file for rule tuning |
ZAP JSON Report Structure
{"site": [{"alerts": [{"name": "...", "riskdesc": "High (Medium)",
"cweid": "79", "count": 3, "solution": "..."}]}]}
Risk Levels
| Level | Action |
|---|---|
| High | Block deployment |
| Medium | Require review |
| Low | Track as tech debt |
| Informational | Log only |
References
- ZAP Docker: https://www.zaproxy.org/docs/docker/
- ZAP Automation: https://www.zaproxy.org/docs/automate/