OWASP ZAP

OWASP ZAP (Zed Attack Proxy), now known as ZAP by Checkmarx, is a free and open source web application security scanner. It sits as a proxy between your browser and the application: it sees all the traffic, analyses it for flaws and lets you run active scans, fuzzing and manual tests. It is the most popular free alternative to Burp Suite and a regular component of DevSecOps pipelines.

What is OWASP ZAP?

ZAP began as an OWASP flagship project and for years was the foundation's go-to tool. Later the project became backed by Checkmarx and took the name ZAP by Checkmarx, keeping its Apache 2.0 licence and open development. It is written in Java and runs on Windows, Linux and macOS, plus official Docker images.

Its main components are:

• Intercepting proxy: captures and modifies requests and responses.
• Passive scanner: reviews traffic without sending anything new (security headers, cookies missing flags, information leaks).
• Spider and AJAX Spider: discover pages, including JavaScript-generated content.
• Active scanner: sends malicious payloads to detect XSS, SQL injection, path traversal and more.
• Fuzzer, scripts and an add-on marketplace.
• Automation Framework and an API for CI/CD integration.

What ZAP is used for

• Auditing web applications and APIs in authorised pentests.
• Automated scans in continuous integration pipelines (DAST).
• Learning how HTTP works and how web vulnerabilities are exploited, ideally alongside labs such as PortSwigger Web Security Academy.
• Checking that new code does not introduce insecure headers or obvious bugs.

Warning: only use it on your own applications or with written authorisation. An active scan can modify data and overload the server.

How to install ZAP

On Windows and macOS download the installer from the official website. On Linux you have several options:

# Kali Linux
sudo apt update && sudo apt install zaproxy

# Snap
sudo snap install zaproxy --classic

# Docker (stable release)
docker pull ghcr.io/zaproxy/zaproxy:stable

When you open the GUI, ZAP offers a Quick Start with automated scanning and manual exploration. For manual mode, launch the preconfigured browser from ZAP (no fiddling with certificates and proxy settings by hand).

Practical examples

Baseline scan with Docker (spider + passive analysis, ideal for CI because it does not attack):

docker run --rm -v $(pwd):/zap/wrk/:rw -t ghcr.io/zaproxy/zaproxy:stable \
  zap-baseline.py -t https://staging.example.com -r report.html

Full scan (includes active scanning; authorised environments only):

docker run --rm -v $(pwd):/zap/wrk/:rw -t ghcr.io/zaproxy/zaproxy:stable \
  zap-full-scan.py -t https://staging.example.com -r full.html

API scan from an OpenAPI definition:

docker run --rm -v $(pwd):/zap/wrk/:rw -t ghcr.io/zaproxy/zaproxy:stable \
  zap-api-scan.py -t https://staging.example.com/openapi.json -f openapi -r api.html

Headless command-line mode with the quick scan:

zap.sh -cmd -quickurl https://staging.example.com -quickout /tmp/report.html

In the manual workflow, browse the application with the browser launched from ZAP, review passive alerts, add the domain to a context, configure authentication and only then run an active scan on that context.

Pro tips

• Always define a context with the exact scope so you never scan third-party domains by accident.
• Configure authentication and users: without a session the scanner only sees the public part.
• Run the baseline on every pull request and the full scan on staging on a schedule.
• Review false positives and mark them; the baseline rules file lets you ignore specific alerts.
• Install beta or alpha add-ons from the marketplace if you need extra rules.

Pros and cons

Pros	Cons
Free and open source, no feature limits	Less polished interface than Burp Suite
Excellent for automation and CI/CD	Uses quite a lot of memory on large projects
Official Docker images and full API	Produces false positives you need to review

OWASP ZAP alternatives

• Burp Suite: the standard for manual web pentesting, with a free Community edition.
• SQLMap: to exploit in depth the SQL injections ZAP detects.
• PortSwigger Web Security Academy: free labs to practise with ZAP or Burp.

Frequently asked questions

Is OWASP ZAP free?

Yes. ZAP is free and open source, with no paid version that unlocks features.

Is it legal to use ZAP?

The tool itself is legal. What determines legality is the target: only scan your own applications or ones whose owner has given explicit permission.

ZAP or Burp Suite?

For automation and tight budgets, ZAP. For intensive manual pentesting many professionals prefer Burp Suite Professional. Knowing both is ideal.

How do I use OWASP ZAP for the first time?

Open ZAP, choose Manual Explore, launch the built-in browser against a test application and browse. The site tree and passive alerts will appear without you doing anything else.

If you want to practise the HTTP and Linux fundamentals behind it, head to the Hackers en Acción Academy.