OWASP ZAP: a web application security scanner for testing your own applications

OWASP ZAP (about 16,000 stars on GitHub) is one of the most widely used free tools for finding security problems in web applications. Simon Bennetts released the first version in 2010 as a fork of the earlier Paros proxy; it became an OWASP flagship project and is now maintained by a core team led by Bennetts and Ricardo Pereira, with hundreds of contributors and a large add-on marketplace. The desktop application is written in Java and runs on Linux, macOS and Windows; a headless mode and a Docker image serve automation.

What it does

ZAP sits between your browser and the application as a proxy, records every request and response, and builds a map of the site. From that map it can run a passive scan, which only inspects traffic that already flowed and flags missing security headers, cookie flags, information leaks and similar issues, and an active scan, which sends crafted requests to look for cross-site scripting, SQL injection, path traversal, server-side request forgery and other weaknesses from the OWASP Top 10. A spider and an AJAX spider discover pages automatically, an API scan mode tests OpenAPI, SOAP and GraphQL definitions, and the automation framework describes a whole test run in a YAML file so it can be repeated in CI.

Who it is for

• Developers who want to test their own application in a staging environment before release.
• QA and DevOps teams that run a baseline scan against every deployment through the Docker image.
• Security teams performing authorised penetration tests, where ZAP is a free alternative or complement to commercial proxies.
• Learners, because the intercepting proxy shows exactly what a browser sends and receives, which makes web security tangible.

How to install and try it

Installers for each platform are on the download page, Homebrew has a cask, and the Docker images are the usual choice for automation. The baseline scan below runs the spider and passive rules only, which makes it safe to try against a development instance of your own application:

docker run --rm -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py -t http://host.docker.internal:8080

The report lists each alert with a risk level, the affected URLs, evidence and a link to the rule’s description. The documentation covers the desktop interface, authentication handling, the automation framework and the API.

Use it responsibly

An active scan sends attack payloads and can create records, trigger emails or overload a fragile server. Run ZAP only against applications you own or have written permission to test, and prefer a staging copy over production. Scanning a system without authorisation is illegal in most countries regardless of intent.

Credit

ZAP was created by Simon Bennetts and is maintained by the ZAP core team and contributors under the OWASP project and, since 2023, also as part of the Software Security Project under the Linux Foundation. It is published under the Apache License 2.0.