OWASP ZAP on Ubuntu 24.04 LTS
by cloudimg
OWASP ZAP on Ubuntu 24.04 LTS by cloudimg
OWASP ZAP on Ubuntu 24.04 LTS by cloudimg
OWASP ZAP (Zed Attack Proxy) is the world's most widely used open-source web application security scanner, performing Dynamic Application Security Testing (DAST). This cloudimg image runs ZAP 2.17.0 in headless daemon mode as an appliance: a long-running ZAP daemon exposing its REST API and local scanning proxy, driven by the API or the ZAP Automation Framework to spider and scan target web applications. ZAP runs as a dedicated zap system user on a Temurin 17 JRE with the API bound to loopback, gated by a per-VM API key generated on first boot, with its home on a dedicated Azure data disk. Backed by 24/7 expert support.
DAST Scanning via API
Drive ZAP from the REST API or the ZAP Automation Framework to spider and scan target web applications for vulnerabilities - ideal for CI/CD-integrated security testing.
Dedicated Data Disk
The ZAP home (sessions, scan results, contexts and add-ons) lives on a dedicated, independently resizable Azure data disk, separate from the OS disk and re-provisioned with every VM.
Secure By Default
The ZAP API and proxy listen on 127.0.0.1:8090 only and are gated by an API key uniquely generated on the first boot of every VM, stored in a root-only file; port 8090 is never opened on the NSG. nginx on port 80 serves a static unauthenticated /health endpoint.
Why Choose cloudimg?
- 24/7 Expert Support with guaranteed 24 hour response. Contact support@cloudimg.co.uk
- Production Ready from Launch Pre configured, security patched, and validated before publication
- Azure Native Integration Built with Azure Linux Agent, cloud init, and Gen2 Hyper V
What is Included
- OWASP ZAP 2.17.0 (official Linux distribution) running as a systemd daemon on a Temurin 17 JRE
- A unique per-VM API key generated on first boot in a root-only file
- ZAP home, sessions, scan results and add-ons on a dedicated Azure data disk
- A loopback-only ZAP API and proxy on 127.0.0.1:8090, fronted by nginx on port 80
- A static unauthenticated /health endpoint for load-balancer probes
Networking
Reach the API over an SSH tunnel (ssh -L 8090:127.0.0.1:8090 azureuser@your-vm-ip); add your own authentication and TLS before exposing any port.
Use Cases
CI/CD-integrated DAST, automated web application security scanning, a self-hosted vulnerability scanner driven by the ZAP API, and AppSec/DevSecOps pipelines.
Visit www.cloudimg.co.uk/guides/owasp-zap-on-ubuntu-24-04-azure for the full user guide.
OWASP, ZAP and Zed Attack Proxy are trademarks of the OWASP Foundation; this image repackages the upstream Apache-2.0 software and is not affiliated with or endorsed by the OWASP Foundation. All trademarks are the property of their respective holders.