https://github.com/hahwul/mzap
⚡️ Multiple target ZAP Scanning
https://github.com/hahwul/mzap
bugbounty dast hacking security zaproxy zaproxy-automation
Last synced: 11 days ago
JSON representation
⚡️ Multiple target ZAP Scanning
- Host: GitHub
- URL: https://github.com/hahwul/mzap
- Owner: hahwul
- License: mit
- Created: 2020-08-22T13:42:10.000Z (over 5 years ago)
- Default Branch: master
- Last Pushed: 2026-02-24T14:28:45.000Z (15 days ago)
- Last Synced: 2026-02-24T18:36:03.804Z (15 days ago)
- Topics: bugbounty, dast, hacking, security, zaproxy, zaproxy-automation
- Language: Go
- Homepage:
- Size: 543 KB
- Stars: 105
- Watchers: 2
- Forks: 17
- Open Issues: 4
-
Metadata Files:
- Readme: README.md
- Funding: .github/FUNDING.yml
- License: LICENSE
- Code of conduct: CODE_OF_CONDUCT.md
- Security: SECURITY.md
Awesome Lists containing this project
- awesome-hacking-lists - hahwul/mzap - ⚡️ Multiple target ZAP Scanning (Go)
README
# mzap
`mzap` is a Crystal CLI for multi-target ZAP scanning.
It dispatches targets across one or more ZAP API hosts, supports optional wait mode, and can export reports.
## Features
- Multiple scan commands: `spider`, `ajaxspider`, `ascan`
- Multi-host dispatch with round-robin scheduling
- Optional wait/poll mode with timeout support
- Report export (`html`/`pdf`) with fallback behavior
- Stop commands for `spider`, `ajaxspider`, `ascan`, or `all`
- Optional config loading from `$HOME/.config/mzap/config.toml` and legacy paths
## Requirements
- Crystal `>= 1.19.1`
- A running ZAP API endpoint (or endpoints)
## Installation
### Homebrew
```bash
brew install hahwul/mzap/mzap
```
### Build From Source
```bash
shards install --frozen
crystal build --release src/mzap_cli.cr -o bin/mzap
```
### Run Without Building
```bash
crystal run src/mzap_cli.cr -- version
```
### Docker Image
```bash
docker build -t mzap .
docker run --rm -v "$PWD:/work" mzap spider --urls /work/samples/target.txt --apis http://host.docker.internal:8090
```
## Usage
```text
Usage:
mzap [command]
Subcommands:
ajaxspider Start Ajax Spider scans in ZAP
ascan Start Active Scan jobs in ZAP
help Show help for a command
spider Start Spider scans in ZAP
stop Stop running scans
version Show mzap version
Flags:
--apikey string ZAP API key (omit when API key auth is disabled)
--apis string Comma-separated ZAP API host URLs
e.g. --apis http://localhost:8090,http://192.168.0.4:8090 (default "http://localhost:8090")
--config string Config file path (TOML supported; default: $HOME/.config/mzap/config.toml)
--report-format Report format after scan completion (html/pdf)
--report-out Report output path (default: mzap-report-.)
--wait Wait for initiated scans to complete
--wait-interval Poll interval in seconds while waiting (default 2)
--wait-timeout Wait timeout in seconds (default 0: no timeout)
-h, --help Show help for mzap
--urls string Path to URL list file (e.g. --urls hosts.txt)
```
## Examples
```bash
# spider scan with two ZAP API hosts
mzap spider --urls samples/target.txt --apis http://localhost:8090,http://192.168.0.4:8090
# run scan, wait for completion, and generate an HTML report
mzap spider --urls samples/target.txt --apis http://localhost:8090 --wait --report-format html --report-out reports/mzap.html
# stop all running scan types
mzap stop all --apis http://localhost:8090
```
## Config
`mzap` automatically loads config when present.
Priority is:
1. Explicit `--config` path (if it exists)
2. `$HOME/.config/mzap/config.toml`
3. `$HOME/.config/mzap/config` + extension variants
4. `$HOME/.mzap` + extension variants
CLI flags always override config values.
```toml
[mzap]
apis = ["http://localhost:8090", "http://192.168.0.4:8090"]
apikey = "your-zap-api-key"
urls = "samples/target.txt"
wait = true
wait_interval = 2
wait_timeout = 0
report_format = "html"
report_out = "reports/mzap.html"
```
## GitHub Action
This repository includes a Docker-based GitHub Action (`action.yml`).
```yaml
- name: Run mzap
uses: hahwul/mzap@
with:
arguments: "spider --urls samples/target.txt --apis http://localhost:8090"
```
## Development
```bash
# tests
crystal spec
# release build
crystal build --release src/mzap_cli.cr -o bin/mzap
```