First of all, I'm running ZAP in a Docker container and will automate ZAP scans using Jenkins. The official docker image seems to have a script that performs spidering and active scans but does not do any fuzzing. Is there a way to fuzz through the command line? I can't do the manual way of going to the GUI and running a fuzz since everything needs to be automated.
1 Answer
No, fuzzing is currently a manual only process. We do plan to add an API but have not had the chance yet.
Its worth noting that even if we do add an API it will still be tricky to automate. In ZAP when you're fuzzing you have to specify exactly what you want to fuzz (per request), what you want to fuzz it with and analyse the results.
In general the active scanner is a better bet in automation.
Having said that, what are you expecting to be able to do with ZAP fuzzing?
