Tools · Web testing tools · 12 / 23
A ZAP baseline against Harbor Ledger
A baseline scan spiders the lab and runs passive checks on what it fetched. It is a coverage pass against http://127.0.0.1:3000, followed by a report you read. It is not a verdict, and it is not the active scanner.
Baseline means spider plus passive rules
OWASP ZAP’s packaged baseline is the scan people put in a pipeline: it explores a site by following links, and it runs the passive rule set over what came back. Passive rules look at headers, cookies, comments, and the shape of responses. They do not fire a catalog of attack payloads. The full active script is a different program, with a different name, and these lessons do not run it.
On the desktop, the same idea is a spider of the lab plus the passive rules that watch what comes back. If the Quick Start dialog has a separate active-scan control, leave it off. If that dialog always runs the active scanner, skip it and use the baseline script, or spider from the Sites tree while you browse and let the passive rules comment. The target string is the part that matters, and the only acceptable value in this lesson is http://127.0.0.1:3000.
The command, pointed at loopback
Run the baseline from a ZAP install on the same machine as Harbor Ledger, so 127.0.0.1 is the lab and not some other network namespace. If you later run ZAP inside a container, loopback inside the container is the container itself. That is a networking fact, and the fix is to give the container a route to the lab on purpose, or to run ZAP on the host. Do not “solve” it by scanning a different, public hostname.
Write the report into the lab folder as harbor-baseline.html. Image names and flag letters drift between ZAP releases. If the script refuses a flag, check the current packaged-scan page in the ZAP documentation and keep the target. The target does not drift.
zap-baseline.py -t http://127.0.0.1:3000 -r harbor-baseline.html # Report file: lab-folder/harbor-baseline.html # Active scanner: off. Use the baseline script if the desktop # dialog cannot keep the active scanner off.
What you do while it runs
Watch the site tree grow under http://127.0.0.1:3000. You should recognize the paths from the Burp map: the invoice pages, the API, health, and the static files. A path you do not recognize is a link the spider found in HTML you ship. Note it. A host you do not recognize means the page sent the spider sideways. Stop the scan and remove that link from the lab before you start again.
The spider will send more requests than your one careful click-through. That is the point of a coverage pass, and it is why the target has to be a lab you can reset. When it finishes, you have a report and a History tab full of ordinary fetches. You do not have a list of compromises.
Worked case: one report, one claim, then stop
Start Harbor Ledger. Run the baseline against http://127.0.0.1:3000 with active scanning off. When the HTML report opens, pick the first alert whose URL is on the lab origin. Write down the alert name, the URL, the risk the tool assigned, and the evidence snippet. Then stop using the report. The next lesson is how to read that row. The lesson after that is why the risk label is not your impact statement.
Delete the report when the note exists, or keep it in the lab folder if you will finish the reading today. Do not file it in a ticket system that people outside the lab can open. The evidence snippets are copies of your responses.
Diagram
Spider the lab, read the report, leave it there
- Target
The only URL you type is http://127.0.0.1:3000, the origin you already run.
- Spider
ZAP fetches pages the way a browser would, following links on that origin.
- Passive
Rules comment on headers, cookies, and responses already in hand. They do not send a payload set.
- Report
You open the HTML report locally and treat each line as a claim to check in History.
What this pass is allowed to be
Target. A hostname from memory, or a site you do not run.
Mode. The full active script, started because the baseline felt too quiet.
Result. A count of alerts treated as a score.
Target. http://127.0.0.1:3000 only.
Mode. Spider plus passive rules. Active scanning stays off.
Result. A local report you will open row by row.
# From a ZAP install on the same machine as Harbor Ledger. # Confirm the current script name in the ZAP docs before you rely on a flag. zap-baseline.py -t http://127.0.0.1:3000 -r harbor-baseline.html # Desktop, when the dialog lets you separate the two: # URL: http://127.0.0.1:3000 # Spider: on # Active scan: off # If Automated Scan cannot leave the active scanner off, use the script above.
Check yourself
1. Which target belongs on the baseline command in this lesson?
2. What does this baseline pass send?
3. The script writes harbor-baseline.html and exits with a warning status. What does that status mean here?