OWASP ZAP (Zed Attack Proxy)

OWASP ZAP is the world's most widely used free web app scanner. It is perfect for developers and functional testers who are new to penetration testing, as well as automated CI/CD pipelines.

When to Use

• Automated DAST in CI/CD Pipelines: Running automated Dynamic Application Security Testing against deployed staging applications.
• Passive Traffic Security Auditing: Analyzing HTTP traffic for missing security headers, insecure cookies, and information disclosure.
• Automated Spidering & API Fuzzing: Crawling web applications and parsing OpenAPI/Swagger specs to discover unlinked endpoints.
• Open-Source Penetration Testing: Providing a zero-cost, open-source alternative to commercial web vulnerability scanners.

Quick Start

# Run a quick scan against a URL
docker run -t owasp/zap2docker-stable zap-baseline.py -t https://www.example.com

Core Concepts