Zap MCP Sqlmap Setup

🚀 Setup Guide for Integrating OWASP ZAP as MCP (Man-in-the-Middle Proxy Server) with SQLMap

This repository contains setup instructions and configuration files for using OWASP ZAP as an MCP server and integrating it with SQLMap, which are suitable for legal security testing and vulnerability assessment.

🚀 Quick Start

Prerequisites

• Docker is installed on the system.
• Basic knowledge of network security testing.
• System administrator or root access rights.

Quick Setup

1. Clone this repository:

git clone https://github.com/UnknownAirtist/zap-mcp-sqlmap-setup.git
cd zap-mcp-sqlmap-setup

2. Run the setup script:

chmod +x setup.sh
./setup.sh

3. Start the ZAP MCP server:

docker-compose up -d

This will start the ZAP server running on port 8080 and the API running on port 8090.

Manual Setup

1. Install OWASP ZAP

You can install ZAP using Docker (recommended):

docker pull owasp/zap2docker-stable

Or download it directly from the official website.

2. Install SQLMap

SQLMap can be installed via the repository:

git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git

3. Configure ZAP as an MCP server:

Run ZAP in daemon mode:

docker run -u zap -p 8080:8080 -p 8090:8090 -i owasp/zap2docker-stable zap.sh -daemon -host 0.0.0.0 -port 8080 -config api.disablekey=true

4. Integrate SQLMap with ZAP:

Use ZAP as a proxy server when using SQLMap:

python sqlmap.py -u "http://target-website.com" --proxy=http://localhost:8080

✨ Features

Advanced Configuration

Custom ZAP Rules

The zap-rules directory contains custom ZAP rules for improving the detection of SQL injection vulnerabilities:

• Copy the .js files to the ZAP script directory.
• Enable them under Tools > Scripts in the ZAP UI.

SQLMap Integration Scripts

The sqlmap-scripts directory contains auxiliary scripts for tighter integration:

• zap-sqlmap-bridge.py: Forward ZAP's discovery results to SQLMap for in-depth testing.
• auto-scan.py: Automatically scan all forms on the target website.

💻 Usage Examples

Basic Scan

./scripts/start-scan.sh http://example.com

Comprehensive Scan with SQLMap Integration

./scripts/full-scan.sh http://vulnerable-website.com

Continuous Integration Setup

Check the GitHub Actions and Jenkins configuration examples in the ci-example directory.

📚 Documentation

Security Precautions

⚠️ Important Note

Use these tools only on systems you own or have explicit permission for. Unauthorized security testing is illegal in most jurisdictions.

Troubleshooting

• Check logs/zap.log for ZAP-related issues.
• Check logs/sqlmap.log for SQLMap-related issues.
• If the server does not respond, ensure that ports 8080 and 8090 are not occupied by other applications.

📄 License

This project is released under the MIT License. For specific information, please refer to the LICENSE file.