Customizing OWASP ZAP using config file

Continuing from the How to run OWASP ZAP as a systemd service post we can go further to customize ZAP with config parameters before starting it up.

The easiest way to set config parameters is to append them to the shell script launching ZAP as follows:

$ zap.sh -host localhost -port 9080 -config api.key=12345 -config scanner.threadPerHost=2 -config scanner.hostPerScan=4

But as one can see it can become unmaintainable. What I propose is instead of inline config parameters, one rather specify a config file using the -configfile <file> command switch.

Using the the previous post’s convention one should rather create a file called zaproxy.conf and then place the config parameters in there as follows:

proxy.ip=localhost
proxy.port=9080
api.key=12345
scanner.threadPerHost=2
scanner.hostPerScan=4

Once done specifying all the config parameters in there one saves it under the working directory of ZAP.

That would be /home/zaproxy/.ZAP/zaproxy.conf if you have followed the steps from the previous post.

Then update the /usr/bin/zaproxy script to include the zaproxy.conf file as follows:

#!/bin/sh

cd /usr/share/zaproxy/
exec ./zap.sh -daemon -configfile $HOME/.ZAP/zaproxy.conf

Note: Check that the zaproxy.conf file belongs to the user running ZAP (using the previous post as an example, this would be the zaproxy user). If the zaproxy.conf is not owned by zaproxy user, one can execute the following command:

$ sudo chown zaproxy:zaproxy zaproxy.conf

Then stop ZAP by either killing the java process or by executing

$ sudo systemctl stop zaproxy

And then start it up again by executing the /usr/bin/zaproxy script or by executing

$ sudo systemctl start zaproxy

To check if the config file has loaded correctly one can check the zap.log file in ZAP’s working directory or by doing the following:

$ wget http://localhost:9080
--2021-04-04 21:27:31--  http://localhost:9080/
Resolving localhost (localhost)... ::1, 127.0.0.1
Connecting to localhost (localhost)|::1|:9080... failed: Connection refused.
Connecting to localhost (localhost)|127.0.0.1|:9080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1196 (1.2K) [text/html]
Saving to: ‘index.html’

index.html                                                 100%[======================================================================================================================================>]   1.17K  --.-KB/s    in 0s      

2021-04-04 21:27:31 (8.52 MB/s) - ‘index.html’ saved [1196/1196]

If it returns a HTTP 200 response then it means the config file has loaded successfully. In essence ZAP’s proxy port has change to 9080, which means the config file has been loaded.