ZAP (formerly OWASP ZAP): Open-Source Web Application Security Scanner for Modern DevSecOps

TL;DR, What Is ZAP?

ZAP (formerly OWASP ZAP) is a free and open-source web application security scanner that has become a staple for security teams everywhere.

For developers and DevSecOps teams, ZAP is an essential tool for bringing security into the earliest stages of development—a true "shift-left" approach. By integrating it into your CI/CD pipeline, you can automatically find and remediate vulnerabilities during development, long before your code reaches production. This proactive strategy helps you reduce the cost and complexity of fixes without slowing down your release cycle, allowing your team to maintain agility while building robust, secure applications.

ZAP is an independent open‑source project, now branded “ZAP by Checkmarx.” The core team is employed by Checkmarx, and ZAP continues to be actively maintained with frequent stable and weekly (pre‑release) builds.

Get the Application Security Best Practices [Cheat Sheet]

This 6-page guide goes beyond basics — it’s a deep dive into advanced, practical AppSec strategies for developers, security engineers, and DevOps teams.

Tu correo electrónico de trabajo aquí

Download

Common use cases

1.  Automated Scanning in CI/CD Pipelines: You can integrate ZAP directly into your CI/CD pipelines to run automated security scans on every code change. This gives developers immediate feedback, helping you catch vulnerabilities early and enforce security gates before deployment—a cornerstone of a mature DevSecOps practice.

2.  Manual Penetration Testing: Security professionals use ZAP as a powerful intercepting proxy and manual testing tool. Its features for manipulating requests, spidering, and active scanning provide the deep, hands-on control you need for comprehensive vulnerability assessments of complex applications.

3.  Developer-Led Security Checks: You can empower your developers to run ZAP on their local machines to scan their code before they even commit it. This proactive approach allows them to find and fix basic security flaws themselves, improving overall code quality and reducing the workload on dedicated security teams.

4.  API Vulnerability Assessment: Teams use ZAP to specifically target and test the security of RESTful and SOAP APIs. By importing API definitions, you can automate scans for common API vulnerabilities like broken authentication, injection flaws, and excessive data exposure.

5.  Security Regression Testing: You can configure ZAP with scripts and context files to perform security regression tests. This ensures that previously fixed vulnerabilities don’t reappear in new releases and that your application's security posture remains strong over time.

Watch 5-minute demo

Watch the demo to learn how Wiz Code scans infrastructure as code, container images, and CI/CD pipelines to catch risks early—before they reach the cloud.

Watch now

How does ZAP work?

ZAP operates as a “man-in-the-middle” proxy, placing itself between your browser and the web application you’re testing. This position gives it the power to intercept, inspect, and even modify all HTTP/HTTPS traffic in real time.

Let's break down its process: ZAP starts by mapping your application's structure with automated crawling, then moves through distinct scanning phases to identify a wide range of security vulnerabilities before compiling everything into a detailed report.

• Spidering and Crawling: First, ZAP uses its spider to automatically navigate your application, following every link to discover pages and resources. This process builds a comprehensive site tree that serves as the map for all further analysis.

• Passive Scanning: As traffic flows through the proxy, ZAP non-intrusively inspects requests and responses. It looks for potential security weaknesses like missing security headers or information leakage, all without sending any active or malicious payloads.

• Active Scanning: In this more aggressive phase, ZAP actively attacks the application. It sends a variety of malicious requests designed to probe for critical vulnerabilities such as SQL injection, cross-site scripting (XSS), and broken authentication, helping you find weaknesses before attackers do.

Core Capabilities

1.  Active and Passive Scanning: ZAP gives you the best of both worlds with its dual scanning modes. Passive scanning non-intrusively monitors traffic to safely identify surface-level issues, while active scanning aggressively probes your application with known attack vectors to uncover deeper vulnerabilities. This combined approach delivers comprehensive coverage, making it a powerful scanner for any phase of testing.

2.  Advanced Spidering for Modern Web Apps: To give you a complete map of your application's attack surface, ZAP includes a traditional spider for static HTML; an advanced AJAX Spider built for modern, JavaScript-heavy applications; and the newer Client Spider for modern client‑rendered apps. This ensures that even complex single-page applications are fully explored, leaving no component un-tested.

3.  Integrated Fuzzing Engine: ZAP’s built-in fuzzer helps you discover vulnerabilities tied to poor input validation by automatically sending huge volumes of unexpected and malformed data to your application's inputs. It comes with pre-configured payloads for common attacks like SQL injection and XSS, and you can also define custom payloads to run tailored tests against specific application logic.

4.  Comprehensive API Security Testing: We know how critical APIs are to modern applications, and ZAP provides specialized features to secure them. It can import API definitions from formats like OpenAPI and GraphQL (via add‑on) to automatically discover and test RESTful and SOAP endpoints for common vulnerabilities, including authentication flaws, injection, and improper data exposure. This helps secure the backend services that power your web and mobile apps.

5.  Powerful Automation and CI/CD Integration: One of ZAP's standout features is its incredible support for automation. Its comprehensive API allows you to script and integrate security testing directly into your CI/CD workflows, enabling your team to run automated penetration tests with every build. This is what a true "shift-left" security practice looks like – scalable, efficient, and embedded in your development lifecycle.

Academia Wiz

Application Risk Management: Embedding AppSec in Every Phase of the SDLC

Leer más

Limitations

1.  Steep Learning Curve for Advanced Features: While you can get basic scans up and running quickly, mastering ZAP’s more advanced capabilities – like scripting, context configuration, and authentication handling – requires a significant time investment. New users should be prepared to dive into tutorials to unlock the tool’s full potential for complex scenarios.

2.  Potential for High False Positives: Like many automated scanners, ZAP can generate a high volume of false positives, especially when using its default policies. Your team will need to perform careful manual verification to distinguish actual vulnerabilities from benign findings, which can slow down remediation efforts if you don't have the expertise to triage alerts effectively.

3.  Performance Intensive for Large Applications: A full active scan on a large, complex web application can be extremely resource-intensive. The process can consume considerable CPU and memory and may take a long time to complete, posing a challenge when you’re trying to integrate it into tight CI/CD pipeline schedules.

4.  Complex Authentication and Session Management: Configuring ZAP to handle modern authentication mechanisms like OAuth, SAML, or MFA can be tricky. While it’s possible through extensive configuration and scripting, it’s not an out-of-the-box process and often requires deep knowledge of both ZAP and your application's authentication flow.

5.  Limited Scope Beyond Web Applications: It's important to remember that ZAP is a highly specialized web application security scanner. It’s not designed to test other targets like thick-client applications, mobile app binaries (beyond their APIs), or network infrastructure. To achieve comprehensive security coverage, you’ll need to supplement ZAP with other specialized tools.

Getting Started:

Ready to get started with OWASP ZAP? 

Step 1:

First, download the latest release for your platform from https://www.zaproxy.org/download/ and extract the archive. Make sure you have Java 8 or newer installed. To launch ZAP, just navigate to the extracted folder and run:

Linux/macOS:

./zap.sh

Windows:

zap.bat

Step 2:

Once ZAP starts, its GUI will open, and you can begin scanning your web applications. For detailed documentation, head over to https://www.zaproxy.org/docs/. If you're a Docker user, you can also run:

docker run -u zap -p 8080:8080 -i ghcr.io/zaproxy/zaproxy

Secure your SDLC from start to finish

See why Wiz is one of the few cloud security platforms that security and devops teams both love to use.

Correo electrónico del trabajo*

Nombre*

Apellido*

País

Número de teléfono*

Empresa*

Mantenme actualizado sobre los lanzamientos de productos de Wiz, noticias de la industria y eventos (puedes darte de baja en cualquier momento)

Suscríbeme a los correos electrónicos de resumen del blog de Wiz

Enviar

Para obtener información sobre cómo Wiz maneja sus datos personales, consulte nuestra Política de privacidad.

Tu correo electrónico de trabajo aquí

Solicita una demo

Alternatives

FAQs