ostorlab.yaml

kind: Agent
name: zap
version: 0.5.2
image: images/logo.png
description: |
  This repository is an implementation of [Ostorlab Agent](https://pypi.org/project/ostorlab/) for the [zap Fingerprinter](https://github.com/urbanadventurer/zap.git).

  ## Getting Started
  To perform your first scan, simply run the following command.
  ```shell
  ostorlab scan run --install --agent agent/ostorlab/zap domain-name tesla.com
  ```

  This command will download and install `agent/ostorlab/zap`.
  For more information, please refer to the [Ostorlab Documentation](https://github.com/Ostorlab/ostorlab/blob/main/README.md)


  ## Usage

  Agent zap can be installed directly from the ostorlab agent store or built from this repository.

   ### Install directly from ostorlab agent store

   ```shell
   ostorlab agent install agent/ostorlab/zap
   ```

  You can then run the agent with the following command:

  ```shell
  ostorlab scan run --agent agent/ostorlab/zap domain-name tesla.com
  ```


  ### Build directly from the repository

   1. To build the zap agent you need to have [ostorlab](https://pypi.org/project/ostorlab/) installed in your machine.  if you have already installed ostorlab, you can skip this step.

  ```shell
  pip3 install ostorlab
  ```

   2. Clone this repository.

  ```shell
  git clone https://github.com/Ostorlab/agent_zap.git && cd agent_zap
  ```

   3. Build the agent image using ostorlab cli.

   ```shell
   ostorlab agent build --file=ostorlab.yaml --force
   ```
   You can pass the optional flag `--organization` to specify your organisation. The organization is empty by default.

   1. Run the agent using on of the following commands:
  	 * If you did not specify an organization when building the image:
  	  ```shell
  	  ostorlab scan run --agent agent//zap domain-name tesla.com
  	  ```
  	 * If you specified an organization when building the image:
  	  ```shell
  	  ostorlab scan run --agent agent/[ORGANIZATION]/zap domain-name tesla.com
  	  ```

  ## License
  [Apache-2](./LICENSE)
license: Apache-2.0
in_selectors:
  - v3.asset.domain_name
  - v3.asset.link
out_selectors:
  - v3.report.vulnerability
docker_file_path: Dockerfile
docker_build_root: .
args:
  - name: "scan_profile"
    type: "string"
    description: "Accepts three values: `baseline` which runs the ZAP spider against the target for (by default)
     1 minute followed by an optional ajax spider scan before reporting the results of the passive scanning. `full`
     which runs the ZAP spider against the target (by default with no time limit) followed by an optional ajax spider
     scan and then a full active scan before reporting the results and `api` Scan which performs an active scan
     against APIs defined by OpenAPI, or GraphQL (post 2.9.0) via either a local file or a URL."
    value: "full"
  - name: "https"
    type: "boolean"
    description: "Target that doesn't specify protocol will use this argument to set the protocol to either http
     or https."
    value: true
  - name: "port"
    type: "number"
    description: "Target that doesn't specify port will use this argument to set the target port."
    value: 443
  - name: "scope_urls_regex"
    type: "string"
    description: "Regexp to define scanning scope, if not set, all URLs are scanned."
  - name: "vpn_config"
    type: "string"
    description: "The vpn config content."
  - name: "dns_config"
    type: "string"
    description: "DNS configuration."
  - name: "crawl_timeout"
    type: "number"
    description: "Max crawl duration in minutes."
    value: 10
  - name: "proxy"
    type: "string"
    description: "Proxy to use for the scan with Zap."