ZAP (Zed Attack Proxy) is a web application security testing tool that helps developers and security professionals identify vulnerabilities in websites and web applications. It combines automated scanning with an intercepting proxy for manual security assessments.
The software sits between a browser and a web application, allowing testers to inspect HTTP and HTTPS traffic. Requests and responses can be modified before being forwarded, making it possible to examine how applications handle unexpected input, authentication information and other potentially sensitive data.
ZAP includes active and passive scanning capabilities. Passive scanning examines traffic without modifying requests, while active scanning sends specially constructed requests to investigate potential vulnerabilities. Its crawling tools help discover application content and identify areas requiring further testing.
An automation framework, API and extensive marketplace of add-ons allow ZAP to be integrated into development workflows and continuous integration pipelines. It is suitable for both exploratory manual testing and repeatable automated assessments.
This is free and open source software.
Key Features
- Intercept and inspect HTTP and HTTPS requests and responses.
- Modify and resend requests for manual security testing.
- Perform passive scanning to identify potential security issues.
- Run active scans to investigate web application vulnerabilities.
- Discover application content using traditional and AJAX spiders.
- Test authentication, session handling and access controls.
- Analyse cookies, headers and other security-sensitive information.
- Fuzz application inputs using configurable payloads.
- Configure scanning policies and authentication contexts.
- Automate security assessments through the Automation Framework.
- Integrate with CI/CD pipelines using scripts and APIs.
- Generate vulnerability reports in multiple formats.
- Extend functionality through add-ons from the ZAP Marketplace.
Website: github.com/zaproxy/zaproxy
Support:
Developer: Checkmarx
License: Apache License 2.0
ZAP is written in Java. Learn Java with our recommended free books and free tutorials.
Related Software
| Vulnerability Detection Tools | |
|---|---|
| sqlmap | Automates testing and exploitation of SQL injection flaws |
| Nuclei | Fast and customisable vulnerability scanner |
| OpenVAS | Full-featured vulnerability scanner |
| Nikto | Web server scanner |
| OWASP ZAP | Popular web application security scanner and penetration testing proxy |
| Vuls | Agentless security scanner for Linux, FreeBSD and network environments |
| Tsunami | Extensible network security scanner for identifying exposed services |
| OSV-Scanner | Scans projects and dependencies against the OSV database |
| grype | Vulnerability scanner for container images and filesystems |
| Dalfox | Fast command-line tool for analysing and exploiting XSS flaws |
| Wapiti | Black-box web application scanner with broad attack coverage |
| testssl.sh | Tests TLS/SSL services, protocols, ciphers and cryptographic weaknesses |
| jSQL Injection | Java tool for automatically testing and exploiting SQL injection flaws |
| sif | Penetration testing suite combining reconnaissance and exploitation tools |
| XSSer | Automates testing, exploitation and reporting of cross-site scripting flaws |
| Terrapin | Terrapin Vulnerability Scanner for the Terrapin attack |
| Trivy | Comprehensive and versatile security scanner |
Read our verdict in the software roundup.
| Security Testing | |
|---|---|
| ZAP | Web app scanner |
| mitmproxy | Interactive HTTPS proxy |
| ffuf | Fast web fuzzer for discovering hidden paths, virtual hosts and parameters |
| Wfuzz | Web application fuzzer and Python library for security assessments |
| sqlmap | Penetration testing tool |
| Dalfox | Identify cross-site scripting vulnerabilities in web applications |
| Commix | Python-based penetration testing tool |
| jwt_tool | Toolkit for auditing JSON Web Tokens and testing security weaknesses |
Read our verdict in the software roundup.
 Explore our carefully curated directory of recommended free and open source software, covering every major software category.The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form. |
Please read our Comment Policy before commenting.