OWASP ZAP ile Otomatik Guvenlik Taramasi

OWASP ZAP Nedir

Acik kaynakli web uygulama guvenlik tarayicisi. Hem manuel hem de otomatik tarama destekler.

Docker ile Kurulum

docker pull zaproxy/zap-stable

Temel Tarama Turleri

# Baseline tarama - hizli, az etkiseviye
docker run -t zaproxy/zap-stable zap-baseline.py 
    -t https://hedef.com 
    -r rapor.html

# Full scan - aktif tarama, daha kapsamli
docker run -t zaproxy/zap-stable zap-full-scan.py 
    -t https://hedef.com 
    -r rapor.html 
    -a

# API tarama
docker run -t zaproxy/zap-stable zap-api-scan.py 
    -t https://hedef.com/api/openapi.json 
    -f openapi 
    -r api-rapor.html

Python API Kullanimi

from zapv2 import ZAPv2
import time

zap = ZAPv2(apikey='gizli-anahtar', proxies={'http':'http://localhost:8080'})

hedef = 'https://test.emrecihan.com.tr'
print('Hedef taraniyor:', hedef)

# Spider (site haritasi)
zap.spider.scan(hedef)
while int(zap.spider.status()) < 100:
    time.sleep(2)

# Aktif tarama
tarama_id = zap.ascan.scan(hedef)
while int(zap.ascan.status(tarama_id)) < 100:
    print(f'Ilerleme: {zap.ascan.status(tarama_id)}%')
    time.sleep(5)

# Bulgular
for uyari in zap.core.alerts(baseurl=hedef):
    print(f"{uyari['risk']}: {uyari['alert']} - {uyari['url']}")

GitHub Actions Entegrasyonu

- name: ZAP Guvenlik Taramasi
  uses: zaproxy/action-baseline@v0.10.0
  with:
    target: 'https://staging.emrecihan.com.tr'
    rules_file_name: '.zap/rules.tsv'
    cmd_options: '-a'

ZAP, DevSecOps pipeline'larina guvenlik taramasini entegre etmenin en kolay yoludur.