OWASP ZAP for Beginners: A Free Web Vulnerability Scanner

ZAP is a free web security proxy and scanner, and a common alternative to the paid editions of Burp Suite. It sits between your browser and a web application, records every request and can scan for weaknesses. Use it only on your own lab or systems you have written permission to test.

Set Up

Kali Linux includes it (zaproxy), and installers exist for Windows, macOS and Linux. Run a deliberately vulnerable application such as DVWA or Juice Shop in a virtual machine, as in our home lab guide.

Automated Scan

• Open ZAP and choose Automated Scan.
• Enter the lab address, for example http://192.168.56.20/, and press Attack.
• ZAP crawls the site (the spider), then attacks what it finds (the active scan).

An active scan sends attack payloads. Never run it against a site you do not own.

Manual Explore

Better results come from browsing the application yourself. Point your browser at ZAP as a proxy (or use its built-in browser), log in, click through every feature and fill every form. ZAP records all of it and checks it passively, which sends nothing harmful. Then run an active scan on the recorded site.

Read the Alerts

Alerts are rated High, Medium, Low and Informational. Treat each as a lead: open the request and response, repeat it by hand and confirm it. Scanners produce false positives and miss logic flaws such as broken access control, so confirm every finding before it goes in a report; see how to write a penetration testing report.

Quick Check from the Command Line

• docker run -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py -t http://192.168.56.20/ runs a passive baseline scan.
• Teams often run it in a build pipeline, so a new release is checked automatically.

Where It Fits

Scanning is one step in web application testing. Learn the flaws behind the alerts in OWASP Top 10 explained. It is practiced in our Application Security course.

Sources and Further Reading

• ZAP documentation