ZAP

ZAP (Zed Attack Proxy) sits between your browser and a web app, records the traffic, and looks for signs of vulnerabilities. Start by running the practice app OWASP Juice Shop on your own computer and point ZAP at it.

ZAP used to be called “OWASP ZAP.” In 2023 it left OWASP and joined the Linux Foundation’s Software Security Project. Since 2024 it has been known as “ZAP by Checkmarx.” According to the official blog, it stays open source under the Apache License 2.0.

This review is for web developers and people who are starting to learn web security testing. After reading it, you can do the following:

• Run an automated scan against Juice Shop on your own computer
• Open an alert and read the request and response that caused it
• Tell passive scanning and active scanning apart, and pick the right one for the target

##What ZAP does

• Records traffic: When your browser goes through ZAP, every request and response is saved.
• Spiders: Follows links and forms to collect the pages on a site.
• Passive scanning: Looks for problems by reading the recorded traffic only. The official guide says it does not change responses in any way and is considered safe.
• Active scanning: Sends requests built from known attacks to find vulnerabilities.
• Automation with Docker: The Docker images include scan scripts you can run in CI/CD.

##Active scanning is an attack

The official docs describe active scanning as an attack on the target and say not to use it on web apps you do not own. It sends the same kind of requests a real attacker would, so it can break a site’s features or data. That is why this review rates its impact as “high.”

ZAP has four modes, which you switch from the toolbar.

The official docs recommend Protected mode so that you only attack the sites you mean to.

##Try it safely against Juice Shop

1. Start Juice Shop on your own computer by following the Juice Shop review. Check that http://localhost:3000 opens.
2. Download the installer for your operating system from the official download page. The Windows and Linux versions need Java 17 or later installed separately. The macOS version includes Java.
3. Start ZAP, open the Quick Start tab, and choose Automated Scan.
4. Enter http://localhost:3000 in URL to attack and click Attack. ZAP collects pages with its spider, scans them passively, and then runs an active scan.
5. Select an alert in the Alerts tab at the bottom. The Response tab highlights the part of the response that triggered it.

Apps like Juice Shop build their pages with JavaScript, so the automated spider can miss some of them. Browsing the app yourself through ZAP records more of it.

##Common uses

The baseline scan runs the spider for one minute by default and reports passive scan results only. The official example looks like this:

docker run -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py -t https://www.example.com

The full scan also runs an active scan and can take a long time. Point it at your own test environment, not production.

##Cautions

##Read next

• cd ../juice-shopOWASP Juice Shopan intentionally vulnerable web app to practice ZAP on
• cd ../nucleiNucleia scanner that checks for known vulnerabilities with templates
• cat ~/guides/lab-setup.mdHow to set up a safe test lab