How is a full scan different from a baseline?

A full scan spiders the site and then runs the active rules, sending attack traffic to confirm real vulnerabilities. A baseline (zap-baseline) only observes passively and reports what it sees, so it is faster and safer to run against production but finds less.

How do I run an authenticated scan?

Define the login in a ZAP context file, pass it with -n, and name the user with -U so ZAP holds a session while it scans. Combine that with -m to give the spider enough time to reach pages that only appear after login.

Can it scan a single-page or JavaScript app?

Yes. Add -j to turn on the Ajax spider so ZAP drives a browser and crawls routes that render through JavaScript before the active scan runs. Without it, the traditional spider misses most client-side navigation on an SPA.

How do I stop known warnings from failing the scan?

Write a config file that maps each rule ID to INFO, IGNORE, or FAIL and pass it with -c, then set the reporting floor with -l. That lets a scheduled scan pass on accepted risk, like a missing CSP header, while still failing on a fresh SQL injection or reflected XSS finding.

Can I get an HTML, JSON, or Markdown report?

The upstream zap-full-scan.py script writes reports with -r (HTML), -J (JSON), -w (Markdown), and -x (XML). Those flags are not exposed as separate node inputs on Trickest; the node captures the run into its FILE and FOLDER outputs instead, which you pass downstream for triage.

How do I automate ZAP scanning on a schedule?

Drop the zap-full-scan node into a Trickest workflow after your discovery and httpx probing nodes, feed it confirmed live URLs, and schedule the workflow. Each run scans the current surface and writes findings you can diff against the last run.

Updated Jul 14, 2026

Scanners

Run an OWASP ZAP full active scan against a web app

Run a full scan against a target URL using ZAP.

Run a full active scan of a web app Reach JavaScript-rendered content Scan behind a login

overview

What zap-full-scan does

zap-full-scan drives OWASP ZAP end to end against a web application: it crawls the site with the spider, then runs the active scan rules that send crafted requests to probe for real vulnerabilities. A baseline pass only watches traffic passively, so the full scan is what surfaces injection, cross-site scripting, and broken access control that passive observation never triggers.

The flags set depth and shape the report. -t takes the target URL with its protocol, -j adds the Ajax spider for JavaScript-rendered routes, and -m caps how long the spider runs. Point -n at a context file and -U at a username to scan behind a login, mark noisy rules as INFO, IGNORE, or FAIL through a -c config file, and trim the report with -l and -s.

On Trickest, zap-full-scan is a Scanners node that reads a target URL and writes a file plus a folder of results. Wire it after discovery and probing so it scans hosts you already confirmed are live, then route its findings into the same triage and reporting path as the rest of your security output.

source github.com/zaproxy/zaproxy

use cases

Where zap-full-scan fits

Run a full active scan of a web app

Point ZAP at a live URL to spider the site and run its active rules, surfacing injection, misconfiguration, and access-control issues a passive baseline would miss.

Reach JavaScript-rendered content

Enable the Ajax spider with -j so ZAP crawls pages and routes that load through JavaScript, widening coverage on single-page apps before the active scan runs.

Scan behind a login

Supply a context file with -n and a username with -U so ZAP authenticates and tests pages that are only reachable to a logged-in user.

Tune report noise for CI gates

Use -l and -s with a -c config file to keep only the findings that matter and mark known warnings as INFO or IGNORE so a scheduled scan does not fail on accepted risk.

reference

zap-full-scan inputs and flags

13 inputs

Name	Type	Flag	Description
target	STRING	-t	Target URL including the protocol, e.g. https://www.example.com.
ajax	BOOLEAN	-j	Use the Ajax spider in addition to the traditional one.
mins	STRING	-m	Number of minutes to spider for (defaults to no limit).
user	STRING	-U	Username for authenticated scans, defined in the context file.
context-file	FILE	-n	Context file loaded before scanning the target.
alpha	BOOLEAN	-a	Include the alpha active and passive scan rules as well.
level	STRING	-l	Minimum level to show: PASS, IGNORE, INFO, WARN, or FAIL.
config_file	FILE	-c	Config file to mark warnings as INFO, IGNORE, or FAIL.

Showing key inputs. zap-full-scan exposes 13 inputs in total.

Full flag reference (13 inputs)

Name	Type	Flag	Description
target	STRING	-t	Target URL including the protocol, e.g. https://www.example.com.
ajax	BOOLEAN	-j	Use the Ajax spider in addition to the traditional one.
mins	STRING	-m	The number of minutes to spider for (defaults to no limit).
user	STRING	-U	Username to use for authenticated scans, must be defined in the given context file.
context-file	FILE	-n	Context file which will be loaded prior to scanning the target.
alpha	BOOLEAN	-a	Include the alpha active and passive scan rules as well.
debug	BOOLEAN	-d	Show debug messages in stdout.
delay	STRING	-D	Delay in seconds to wait for passive scanning.
level	STRING	-l	Minimum level to show: PASS, IGNORE, INFO, WARN, or FAIL; use with -s (short-output) to hide example URLs.
max-time	STRING	-T	Max time in minutes to wait for ZAP to start and the passive scan to run.
config_file	FILE	-c	Config file to use to mark warnings as INFO, IGNORE, or FAIL.
zap-options	STRING	-z	ZAP command line options passed through to the scanner.
short-output	BOOLEAN	-s	Short output format, do not show PASSes or example URLs.

example

Run zap-full-scan

zap-full-scan · command

# full active scan, Ajax spider on, 10-minute spider cap, short reportzap-full-scan.py -t https://www.example.com -j -m 10 -s -l WARN

sample output

Total of 48 URLsWARN-NEW: Absence of Anti-CSRF Tokens [10202] x 4	https://www.example.com/login (200 OK)WARN-NEW: Content Security Policy (CSP) Header Not Set [10038] x 11	https://www.example.com/ (200 OK)FAIL-NEW: Cross Site Scripting (Reflected) [40012] x 1	https://www.example.com/search?q=test (200 OK)FAIL-NEW: SQL Injection [40018] x 1	https://www.example.com/product?id=1 (200 OK)FAIL-NEW: 2	WARN-NEW: 2	INFO: 0	IGNORE: 0	PASS: 46

guidance

Choosing zap-full-scan

Use zap-full-scan when you have a live web app URL and want a complete active ZAP scan, not just a passive baseline. For an API defined by a spec, use zap-api-scan. For a multi-step ZAP run, use zap-automation-framework.

zap-api-scan

ZAP against an API contract rather than a crawlable site. Use it for specs, not pages.

zap-automation-framework

Drives ZAP from one YAML plan. More flexible when a single scan is not enough.

nikto

Classic web server scanner. Lighter and faster, with far less depth than a ZAP active scan.

faq

zap-full-scan questions

Yes. It is dynamic application security testing: it runs OWASP ZAP against a live URL, spiders the app, and then fires active scan rules that send real requests to find vulnerabilities at runtime. That is the DAST model, as opposed to reading source code the way a SAST scanner does.

Run zap-full-scan yourself

A target URL is probed by httpx, then zap-full-scan spiders and actively scans the live host and writes the findings as a queryable output.

Run zap-full-scan in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

target

STRING

-t

Target URL including the protocol, e.g. https://www.example.com.

ajax

BOOLEAN

-j

Use the Ajax spider in addition to the traditional one.

mins

STRING

-m

Number of minutes to spider for (defaults to no limit).

user

STRING

-U

Username for authenticated scans, defined in the context file.

context-file

FILE

-n

Context file loaded before scanning the target.

alpha

BOOLEAN

-a

Include the alpha active and passive scan rules as well.

level

STRING

-l

Minimum level to show: PASS, IGNORE, INFO, WARN, or FAIL.

config_file

FILE

-c

Config file to mark warnings as INFO, IGNORE, or FAIL.

Name

Type

Flag

Description

target

STRING

-t

Target URL including the protocol, e.g. https://www.example.com.

ajax

BOOLEAN

-j

Use the Ajax spider in addition to the traditional one.

mins

STRING

-m

The number of minutes to spider for (defaults to no limit).

user

STRING

-U

Username to use for authenticated scans, must be defined in the given context file.

context-file

FILE

-n

Context file which will be loaded prior to scanning the target.

alpha

BOOLEAN

-a

Include the alpha active and passive scan rules as well.

debug

BOOLEAN

-d

Show debug messages in stdout.

delay

STRING

-D

Delay in seconds to wait for passive scanning.

level

STRING

-l

Minimum level to show: PASS, IGNORE, INFO, WARN, or FAIL; use with -s (short-output) to hide example URLs.

max-time

STRING

-T

Max time in minutes to wait for ZAP to start and the passive scan to run.

config_file

FILE

-c

Config file to use to mark warnings as INFO, IGNORE, or FAIL.

zap-options

STRING

-z

ZAP command line options passed through to the scanner.

short-output

BOOLEAN

-s

Short output format, do not show PASSes or example URLs.

Total of 48 URLsWARN-NEW: Absence of Anti-CSRF Tokens [10202] x 4 https://www.example.com/login (200 OK)WARN-NEW: Content Security Policy (CSP) Header Not Set [10038] x 11 https://www.example.com/ (200 OK)FAIL-NEW: Cross Site Scripting (Reflected) [40012] x 1 https://www.example.com/search?q=test (200 OK)FAIL-NEW: SQL Injection [40018] x 1 https://www.example.com/product?id=1 (200 OK)FAIL-NEW: 2 WARN-NEW: 2 INFO: 0 IGNORE: 0 PASS: 46

Run an OWASP ZAP full active scan against a web app

What zap-full-scan does

Where zap-full-scan fits

Run a full active scan of a web app

Reach JavaScript-rendered content

Scan behind a login

Tune report noise for CI gates

zap-full-scan inputs and flags

Run zap-full-scan

Choosing zap-full-scan

zap-api-scan

zap-automation-framework

nikto

zap-full-scan questions

More Scanners tools

airixss

alterx

bomber

broken-link-checker

chopchop

cmseek

Run zap-full-scan yourself

Run an OWASP ZAP full active scan against a web app

What zap-full-scan does

Where zap-full-scan fits

Run a full active scan of a web app

Reach JavaScript-rendered content

Scan behind a login

Tune report noise for CI gates

zap-full-scan inputs and flags

Run zap-full-scan

Choosing zap-full-scan

zap-api-scan

zap-automation-framework

nikto

zap-full-scan questions

More Scanners tools

airixss

alterx

bomber

broken-link-checker

chopchop

cmseek

Run zap-full-scan yourself