ZAP
Open-source web application security scanner and intercepting proxy for detecting web flaws during development and testing.
Technical Architecture & Overview
ZAP (Zed Attack Proxy) is an open-source web application security scanner and intercepting proxy. It left OWASP in 2023 and is now an independent open-source project controlled by the ZAP Core Team and supported by Checkmarx.
Targeted Technical Use Cases
Automated DAST scanning in CI/CD pipelines and manual web application penetration testing.
Evaluation & Trade-offs
Core Strengths
- +Free and open source under the Apache-2.0 license.
- +REST API and Docker images for pipeline automation.
- +Add-on marketplace and scripting support for custom authentication and scanning logic.
Trade-Offs & Limitations
- -Release installers are currently unsigned, so Windows and macOS show security warnings on first launch.
- -Advanced manual testing workflows may require writing custom scripts.
Defensive Security Application
Running automated dynamic scans on staging environments to catch OWASP Top 10 flaws before release.
Frequently Asked Questions
What is ZAP?→
ZAP (Zed Attack Proxy) is an open-source web application security scanner and intercepting proxy. It left OWASP in 2023 and is now an independent open-source project controlled by the ZAP Core Team and supported by Checkmarx.
What is ZAP used for?→
Automated DAST scanning in CI/CD pipelines and manual web application penetration testing.
What are the strengths of ZAP?→
- +Free and open source under the Apache-2.0 license.
- +REST API and Docker images for pipeline automation.
- +Add-on marketplace and scripting support for custom authentication and scanning logic.
What are the limitations of ZAP?→
- +Release installers are currently unsigned, so Windows and macOS show security warnings on first launch.
- +Advanced manual testing workflows may require writing custom scripts.
How is ZAP used defensively?→
Running automated dynamic scans on staging environments to catch OWASP Top 10 flaws before release.