ZAP
Open-source web application security scanner and intercepting proxy for detecting web flaws during development and testing.
Technical Architecture & Overview
ZAP (Zed Attack Proxy) is an open-source web application security scanner and intercepting proxy. It left OWASP in 2023 and is now an independent open-source project controlled by the ZAP Core Team and supported by Checkmarx.
Targeted Technical Use Cases
Automated DAST scanning in CI/CD pipelines and manual web application penetration testing.
Evaluation & Trade-offs
Core Strengths
- +Completely free and open-source with no artificial feature restrictions.
- +Extensive REST API and Docker images for pipeline automation.
- +Large add-on ecosystem for custom authentication and scanning scripts.
Trade-Offs & Limitations
- -UI can feel dated compared to modern commercial proxies.
- -Advanced manual testing workflows may require writing custom scripts.
Defensive Security Application
Running automated dynamic scans on staging environments to catch OWASP Top 10 flaws before release.
Frequently Asked Questions
What is ZAP?→
ZAP (Zed Attack Proxy) is an open-source web application security scanner and intercepting proxy. It left OWASP in 2023 and is now an independent open-source project controlled by the ZAP Core Team and supported by Checkmarx.
What is ZAP used for?→
Automated DAST scanning in CI/CD pipelines and manual web application penetration testing.
What are the strengths of ZAP?→
- +Completely free and open-source with no artificial feature restrictions.
- +Extensive REST API and Docker images for pipeline automation.
- +Large add-on ecosystem for custom authentication and scanning scripts.
What are the limitations of ZAP?→
- +UI can feel dated compared to modern commercial proxies.
- +Advanced manual testing workflows may require writing custom scripts.
How is ZAP used defensively?→
Running automated dynamic scans on staging environments to catch OWASP Top 10 flaws before release.