how the baseline scan runs with a configuration file. Where is the file how we can use in with docke-CodePudding

Am using zap Baseline Scan i want to Change WARN to Ignore Rules. I don't have idea what is Configuration File and how i can use it in my command line when i am using ZAP docker image. I am Using Docker to run passive scan by command and generating report.

CodePudding user response：

Per the published docs, https://www.zaproxy.org/docs/docker/baseline-scan/ :

-g gen_file generate default config file (all rules set to WARN)

It's just a text file so edit it and use it:

-c config_file    config file to use to INFO, IGNORE or FAIL warnings
-u config_url     URL of config file to use to INFO, IGNORE or FAIL warnings

For example:

docker run -v $(pwd):/zap/wrk/:rw -t owasp/zap2docker-stable zap-baseline.py -t https://www.example.com -c /zap/wrk/my.conf -r /zap/wrk/testreport.html

Where my.conf is in the mapped pwd, then the report is written there as well.