Skip to main content
OWASP Zed Attack Proxy (ZAP) is a free, open-source web application security scanner trusted by developers and security teams. Operating as an HTTP/HTTPS proxy, ZAP intercepts and logs traffic between your browser and the target application. This setup lets you inspect, modify, and replay requests to uncover security flaws early.

​
Key Benefits

  • Open-Source & Community-Driven: Backed by OWASP with regular updates.
  • Extensible Add-Ons: Customize scans with community scripts and extensions.
  • CI/CD Ready: Automate security checks in your pipeline for continuous feedback.

​
Testing Modes

Scan ModeDescriptionIdeal Use Case
Passive ScanningObserves traffic without alteration, flags missing headers or insecure cookiesOngoing development
Active ScanningInjects payloads and probes responses to detect vulnerabilities automaticallyPre-release security testing

​
Baseline vs. In-Depth Scans

Scan TypeScopeDurationUse Case
Baseline AssessmentQuick, non-intrusive checksMinutesCI/CD pre-merge checks
In-Depth AnalysisComprehensive, rule-based testingHoursNightly or weekly audits
The image is an infographic about using Zed Attack Proxy (ZAP) for penetration testing, detailing modes of testing, baseline assessments, and in-depth scanning schedules. It includes elements like active engagement, passive monitoring, swift scans, and detailed analysis.
Only perform active scans on applications you own or have explicit permission to test. Unauthorized scanning may violate legal or organizational policies.
By default, ZAP listens as a proxy on http://127.0.0.1:8080. Configure your browser or API client to route traffic through ZAP for accurate results.

​
Getting Started with ZAP CLI

Scan from the command line to integrate seamlessly with scripts and pipelines: 
# Run a quick baseline scan and generate an HTML report
zap-baseline.py -t https://example.com -r baseline-report.html

# Execute a full-depth active scan with detailed reporting
zap-full-scan.py -t https://example.com -r full-scan-report.html

​
Integrating ZAP into Your Workflow

  • Automate baseline assessments on every build for immediate vulnerability feedback.
  • Enable passive scanning during feature development to catch missing headers early.
  • Schedule full active scans overnight for exhaustive coverage and historic tracking.

Watch Video