I'm trying to execute a command to attack an application with login but I dont know how to pass my user and password to the url.
The login sends a post with user and password to verify if exist.
command to atack.
docker run --rm -v $(pwd):/zap/wrk/:rw -t owasp/zap2docker-stable zap-baseline.py -t http://172.31.95.32:8080/myapp/login -g gen.conf -r testreport.html authMethodName : formBasedAuthentication authMethodConfigParams :loginUrl=http://172.31.95.32:8080/myapp/login
You'd be best off running ZAP in gui mode and sorting out your Context config, which you can export. You can then import and re-use your context within whatever CI or CD process(es) you need.
zap-baseline.py is meant to do exactly what it's name implies. Provide a shallow (passive only) assessment of your app/service.
Further details about ZAP Baseline Scan are available here:
FYI.
I had to use ictu/zap2docker-weekly image to accomplish this goal.
here is the repo with some examples.