GO KALI FREE

OWASP ZAP

Web Application

Intermediatemedium risk

OWASP ZAP (Zed Attack Proxy) is the world's most widely used free and open-source web application security scanner. Maintained under the OWASP foundation, ZAP serves as an intercepting proxy, automated crawler, active vulnerability scanner, WebSocket inspector, and CI/CD security automation pipeline.

Installation

sudo apt update && sudo apt install -y zaproxy

Basic Syntax

zaproxy [options]

Quick Facts

Full Name
OWASP Zed Attack Proxy
License
Apache License 2.0 (100% Free & Open Source)
Author
Simon Bennetts & OWASP Foundation Community
Written In
Java, Python, JavaScript
Platforms
Linux (Kali/Debian), Windows, macOS, Docker
Category
Dynamic Application Security Testing (DAST)
Package Name
zaproxy
Default Proxy Port
8080 (127.0.0.1)

Tool Overview

OWASP ZAP (Zed Attack Proxy) is the most widely adopted free and open-source web application security testing tool in the cybersecurity industry. Designed for both beginners and seasoned penetration testers, ZAP acts as a man-in-the-middle proxy between your web browser and the target application, allowing you to intercept, inspect, and modify HTTP and WebSocket traffic in real time.

Unlike commercial alternatives that lock essential features behind costly enterprise paywalls, OWASP ZAP provides unrestricted access to automated crawling (traditional and AJAX spiders), active vulnerability scanning, powerful fuzzing engines, anti-CSRF token handling, and automated authentication scripts completely free of charge.

ZAP is also built from the ground up for modern DevSecOps environments. Through its comprehensive REST API, Docker images, and Automation Framework (AF), security engineers routinely integrate ZAP into GitHub Actions, GitLab CI, and Jenkins to automatically test web apps and APIs for OWASP Top 10 vulnerabilities with every software release.

Common Commands

zaproxyLaunch OWASP ZAP in full Graphical User Interface (GUI) mode
zaproxy -daemon -port 8080 -host 127.0.0.1Start ZAP as a background headless daemon listening on localhost:8080
zaproxy -cmd -quickurl https://example.com -quickout /tmp/zap-report.htmlRun an automated command-line quick scan and export an HTML vulnerability report
zap-baseline.py -t https://example.com -r baseline-report.htmlExecute the official ZAP Docker baseline passive scan (safe for CI/CD pipelines)
zap-full-scan.py -t https://example.com -r full-scan-report.htmlExecute the full active vulnerability scan including automated attacks
zap-api-scan.py -t openapi.json -f openapi -r api-report.htmlScan a REST API using an OpenAPI/Swagger definition file
zaproxy -daemon -config api.key=change-me-key -config api.addrs.addr.name=.* -config api.addrs.addr.regex=trueStart ZAP daemon with custom API key and allow remote API connections
curl http://localhost:8080/JSON/core/view/alerts/Query ZAP REST API for all detected vulnerability alerts in JSON format
curl http://localhost:8080/JSON/spider/action/scan/?url=https://example.comTrigger automated web crawler via the ZAP REST API
curl http://localhost:8080/JSON/ascan/action/scan/?url=https://example.comStart an active vulnerability scan on target URL via REST API
zaproxy -versionDisplay installed OWASP ZAP version and build information
zaproxy -addonupdateCheck for and update all installed ZAP marketplace add-ons from command line
zaproxy -addoninstall ascanrulesBetaInstall beta active scanner rules add-on for broader vulnerability coverage
zaproxy -dir /path/to/custom/homeRun ZAP with an isolated user directory and custom configuration session
zaproxy -session /path/to/session.sessionOpen and resume an existing saved ZAP penetration testing session

Step-by-Step Guide

  1. 1Open terminal in Kali Linux and start ZAP by typing: zaproxy
  2. 2Choose whether to persist the ZAP session to a database file or use a temporary session
  3. 3To use Automated Scan: enter target URL and click 'Attack' to run the Spider and Active Scanner
  4. 4To use Manual Explore: configure browser proxy to 127.0.0.1:8080 or click 'Launch Browser' inside ZAP
  5. 5Install the ZAP Root CA certificate in your browser to inspect HTTPS traffic seamlessly
  6. 6Browse target web application while ZAP passively analyzes HTTP requests and responses
  7. 7In the Sites tree, right-click target endpoint > Attack > Active Scan to run targeted vulnerability probes
  8. 8Review findings in the Alerts tab categorized by Risk (High, Medium, Low, Informational)
  9. 9Generate executive and technical reports via Report > Generate Report (HTML, XML, JSON, or Markdown)

Warnings

Use Cases

Web Application Penetration Testing

Map out attack surfaces, discover hidden endpoints, intercept authorization tokens, and test for access control bypasses.

DevSecOps CI/CD Automation

Run automated baseline and API security scans in pull requests to catch vulnerabilities before staging deployment.

REST & GraphQL API Auditing

Import OpenAPI, Swagger, or GraphQL schemas to automatically fuzz endpoints for broken object level authorization (BOLA) and injection.

Security Training & CTF Challenges

Practice exploiting vulnerabilities on intentionally vulnerable platforms like OWASP Juice Shop, WebGoat, and DVWA.

Key Features

Related Tools

SQLMap

Web Application

SQLMap is an open-source penetration testing tool that automates SQL injection detection and exploitation. It supports five SQL injection types (boolean-based blind, time-based blind, error-based, UNION query-based, and stacked queries) and over 30 database backends including MySQL, Oracle, PostgreSQL, Microsoft SQL Server, and many more.

Burp Suite

Web Application

Burp Suite is a comprehensive web application security testing platform. It can intercept HTTP/HTTPS traffic, spider websites, scan for vulnerabilities, and includes tools for manual testing like Repeater and Intruder.

Wapiti

Web Application

Wapiti allows you to audit the security of your websites or web applications. It performs black-box scanning by crawling pages and injecting payloads to discover vulnerabilities like SQL injection, XSS, and file inclusions.

Commix

Web Application

Commix (Command Injection Exploiter) is an automated tool designed to test, detect, and exploit command injection vulnerabilities in web applications, facilitating automated OS shell access.

FFUF

Web Application

FFUF (Fuzz Faster U Fool) is an extremely fast, open-source web fuzzer written in the Go programming language. Penetration testers and bug bounty hunters use the FFUF tool for directory brute forcing, file discovery, parameter fuzzing, virtual host discovery, and REST API fuzzing by injecting wordlist entries into any part of an HTTP request using the FUZZ keyword.

XSSer

Web Application

XSSer (Cross Site Scripting Exploiter) is an automatic framework to detect, exploit, and report XSS vulnerabilities in web applications. It contains features to bypass several filters and various options for automated payload generation.

Related Cybersecurity Guides

Web Security · Beginner

OWASP Top 10 Explained: The 10 Most Critical Web Application Security Risks

OWASP Top 10 explained with real examples: broken access control, injection, cryptographic failures and all 10 risks, how to test each one safely, and how to fix it.

Tools · Intermediate

Burp Suite Introduction: Web Application Security Testing

Learn how to use Burp Suite for web application security testing including proxy configuration, core tools, and testing workflows.

Web Security · Intermediate

SQL Injection Basics: Understanding and Preventing Database Attacks

Learn how SQL injection attacks work, how to test for them, and how to prevent them in your web applications using parameterized queries and other defenses.

Web Security · Intermediate

Web Security Fundamentals: OWASP Top 10 and Beyond

A comprehensive guide to web application security covering the OWASP Top 10 vulnerabilities, defense in depth strategies, and secure development lifecycle practices.

Frequently Asked Questions

Is OWASP ZAP completely free?

Yes, OWASP ZAP is 100% free and open-source under the Apache 2.0 license. Unlike Burp Suite, ZAP has no restrictions on automated scanning, multi-threading, or reporting.

How does OWASP ZAP compare to Burp Suite?

Burp Suite Professional is renowned for its manual testing workflows and intruder engine, but costs $499/year. OWASP ZAP provides free automated scanning, open REST APIs, AJAX crawling, and native CI/CD integration at zero cost, making it the top open-source alternative.

How do I install OWASP ZAP in Kali Linux?

In Kali Linux, ZAP is available directly from the APT repositories. Run 'sudo apt update && sudo apt install -y zaproxy', then launch it by running 'zaproxy' in the terminal.

Can OWASP ZAP scan modern Single Page Applications (SPAs)?

Yes. ZAP includes an AJAX Spider that uses real headless browser automation (via Chrome or Firefox) to execute client-side JavaScript, discover dynamic DOM events, and click buttons in React, Angular, and Vue applications.

How do I run OWASP ZAP in a headless CI/CD pipeline?

You can run ZAP without a GUI using its official Docker containers (e.g., 'docker run -t zaproxy/zap-stable zap-baseline.py -t https://example.com') or by launching it as a daemon with 'zaproxy -daemon -port 8080'.

What is the difference between ZAP Passive and Active scanning?

Passive scanning only analyzes HTTP requests and responses passing through the proxy without modifying traffic or sending new packets (safe for production). Active scanning actively injects malicious attack payloads (SQLi, XSS, command injection) to prove exploitability.

How do I inspect HTTPS traffic with OWASP ZAP?

In ZAP, go to Tools > Options > Dynamic SSL Certificates, click 'Generate' or 'Save', and import the generated Root CA certificate into your web browser's trusted certificate store.

Does ZAP support API testing?

Yes, ZAP has built-in add-ons for OpenAPI/Swagger, SOAP, and GraphQL. You can import an API definition file, and ZAP will automatically parse endpoints and test each parameter for vulnerabilities.

Tags

#web-security#vulnerability-scanner#proxy#owasp#penetration-testing#dast#automated-testing

Output Explanation

ZAP organizes vulnerabilities into Alerts classified by Risk (High: Red flag, Medium: Orange, Low: Yellow, Informational: Blue) and Confidence (Certain, Firm, Tentative). Each alert details the vulnerable URL, parameter, HTTP request/response evidence, CVE/CWE reference, and remediation advice.

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.