OWASP ZAP Overview: How It Works, Features and a Safe First Demo

Key takeaways

• ZAP is an open-source DAST tool and intercepting proxy.
• Passive scans only observe, while active scans attack and need authorisation.
• Practise on a local vulnerable app such as OWASP Juice Shop.
• Automated scans miss logic flaws, so combine them with manual testing.

What is ZAP?

OWASP ZAP (Zed Attack Proxy) is a free, open-source web application security scanner and intercepting proxy. It is a dynamic application security testing (DAST) tool, so it tests a running application from the outside, as an attacker would. The project documentation is at zaproxy.org, and it is also part of the wider OWASP community. Use it only on applications you own or have permission to test.

How ZAP works

1. Proxy. Your browser sends traffic through ZAP, so you can inspect and change each request and response.
2. Spider and AJAX spider. ZAP crawls the app to discover pages and endpoints, including JavaScript-heavy ones.
3. Passive scan. While you browse, ZAP flags issues from the traffic alone, such as missing security headers or cookies without flags. This does not attack the app.
4. Active scan. ZAP sends attack payloads to find issues such as injection and cross-site scripting. This can change data or cause errors, so never run it against production without approval.
5. Report. Alerts are ranked by risk and confidence, and can be exported.

What are the main features?

A safe first demo

Practise on a deliberately vulnerable application such as OWASP Juice Shop, run locally.

1. Start Juice Shop on your own machine, for example with Docker.
2. Open ZAP, use its automated scan on the local address, and let the spider and passive scan finish.
3. Review the Alerts tab. Compare high-risk findings with what you can reproduce manually, and note any false positives.
4. Run an active scan on the same local app, then read the report.

The step-by-step approach is covered in our ZAP vulnerability testing guide.

What are the strengths and limits?

• Strengths: free, active community, good for learning and CI use.
• Limits: automated scanners miss logic flaws and business-rule bugs, produce false positives and need authentication set up properly. Pair ZAP with manual testing and review results by hand.

Compare it with other tools in top web application testing tools and top VAPT tools.

Using ZAP in a secure development pipeline

Teams often run a passive "baseline" scan against each build and schedule a deeper scan on a test environment. Failing a build on high-risk alerts, with a managed list of accepted false positives, brings issues to developers early.

Next steps

For structured practice with web testing tools, see the Web Application Hacking and Security course.

Related reading

• Burp Suite | The Ultimate Tool for Web Application Security Testing