web.zap-activeOWASP ZAP active scan
Runs the OWASP ZAP full scan (zap-full-scan.py: spider, then the ACTIVE scanner) from the pinned Docker image or a local install. The active scanner sends attack payloads (injection strings, fuzzing, forced browsing) and can create or alter data, so it only runs against a host listed in settings["web.zap-active"].allowHosts (exact host name) and that setting is only honoured from a trusted config (`--config <path>`), never from a config found inside the target. settings["web.zap-active"].maxMinutes (default 10) bounds the spider and the active scan. Localhost targets are reached through host.docker.internal. Authenticated scans are not supported. Never point it at production or at systems you do not own.
- Engine
- Wrapped scanner
- Wraps
docker- Targets
- URL, Web app
- Areas
- Security
- Runs
- Opt-in: only when selected with --only
- Network
- Only the target itself
Run only this auditor
bunx openaudit https://example.com --only web.zap-activeWraps docker. When it isn't installed, the auditor is skipped with an install hint and the rest of the audit runs.