owasp-zap
OWASP ZAP
Overview
OWASP ZAP is an open-source web application security scanner. It maps an application with a spider (and an Ajax spider for JavaScript apps), passively analyses every response, and can run active scans that send attack payloads. It ships as a desktop app, a headless CLI, a REST API and Docker images. Latest release checked: 2.17.0. The Docker image is ghcr.io/zaproxy/zaproxy:stable (other tags: weekly, nightly, bare); the old owasp/zap2docker-* names are gone. The desktop and CLI installs need Java 17 or newer.
Three packaged scripts live in the image:
| Script | What it does | Sends attacks? |
|---|---|---|
zap-baseline.py |
Spiders the target (1 minute by default), waits for passive scanning, reports | No attack payloads, but it does crawl the site |
zap-full-scan.py |
Spider, optional Ajax spider, passive scan, then an active scan | Yes |
zap-api-scan.py |
Imports an OpenAPI, SOAP or GraphQL definition, then scans the endpoints | Yes, unless -S |
ZAP's documentation says the Automation Framework (YAML plans run with zap.sh -cmd -autorun plan.yaml) will in time replace the packaged scans; use it when you need authentication, contexts or custom job order.
Instructions
- Only scan systems you own or have written permission to test. Active and full scans modify data (they submit forms and may create records), so run them against staging or a disposable copy, never production.