Catalog / Security & identity

ZAP

DAST scanner for web applications and APIs

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

Azure Marketplace2.17.0↗
Availability and pricing
CloudVersionSoftware priceLast build
Azure Marketplace
VM image · plan payg-gen2 · Gen2
2.17.0$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-08-12Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseApache-2.0
UpstreamZAP Development Team
Machine-readableproduct.json · catalog.json
What is ZAP

ZAP (Zed Attack Proxy) is the most widely used open-source dynamic application security testing scanner. It finds vulnerabilities in a running web application or API the way an attacker would - by sending real requests and analysing the responses - rather than by reading source code. A spider maps the application, passive rules inspect every response as it passes, and active rules probe for injection, cross-site scripting, broken access control, insecure deserialisation, path traversal and misconfiguration. ZAP imports OpenAPI, SOAP and GraphQL definitions to scan APIs that have no browsable UI, scores findings by confidence and risk, and exports HTML, JSON, XML or Markdown reports. Everything it does is driven by a documented REST API, which is what makes it the standard choice for automated security testing inside a build pipeline.

What the Lynxroute image adds

Security hardening:

  • Per-instance API key - generated at first boot, never baked into the image; every scanner view and action requires it
  • Scanner bound to loopback - the daemon listens on 127.0.0.1 only; nginx terminates TLS on 443 and is the sole path in
  • Not usable as an open proxy - ZAP doubles as an intercepting proxy, so the reverse-proxy configuration pins the upstream host and the appliance refuses to relay traffic to third-party sites
  • No outbound calls on first boot - scan rules are baked into the image and usage telemetry is switched off; the VM works in an egress-restricted subnet
  • CVE scan - every image is scanned for vulnerabilities with Trivy before release, and the bundled Java components are additionally checked against the OSV advisory database
  • UFW firewall - only 22 and 443 open; the scanner port is never externally reachable
  • fail2ban - SSH brute-force protection
  • AppArmor - mandatory access control

OS hardening (CIS Level 1):

  • CIS Level 1 hardened - CIS Ubuntu 24.04 LTS Level 1 Benchmark via ansible-lockdown
  • auditd - system call auditing for critical paths
  • SSH hardening - PasswordAuthentication disabled, key-only access
  • Kernel hardening - SYN cookies, ASLR, rp_filter, TCP BBR
  • /tmp as tmpfs - nosuid, nodev, noexec
  • Azure IMDS endpoints - egress rules pre-configured (169.254.169.254, 168.63.129.16)

Compliance artifacts (inside the VM):

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report - OpenSCAP HTML at /etc/lynxroute/cis-report.html
  • Tailored CIS profile - /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
  • Scan reports - HTML, JSON, XML and Markdown, generated on demand through the API
Deploy

Launch in one command

Credentials are generated at first boot and written to /root/zap-credentials.txt.

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer zap --plan payg-gen2
az vm create -g my-rg -n zap --size Standard_D2s_v3 \
  --image lynxroute:zap:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

No release notes recorded yet.