OWASP ZAP (short for Zed Attack Proxy) is an
open-source
Open source is source code that is made freely available for possible modification and redistribution. Products include permission to use the source code, design documents, or content of the product. The open-source model is a decentralized sof ...
web application security scanner A dynamic application security testing (DAST) is a non functional testing process where one can assess an application using certain techniques and the end result of such testing process covers security weaknesses and vulnerabilities present in an ap ...
.
It is intended to be used by both those new to application security as well as professional penetration testers.
It is one of the most active Open Web Application Security Project (
OWASP) projects and has been given Flagship status.
When used as a
proxy server it allows the user to manipulate all of the traffic that passes through it, including traffic using
HTTPS.
It can also run in a
daemon mode which is then controlled via a
REST API
An application programming interface (API) is a way for two or more computer programs to communicate with each other. It is a type of software Interface (computing), interface, offering a service to other pieces of software. A document or standa ...
.
ZAP was added to the
ThoughtWorks Technology Radar on May 30, 2015 in the Trial ring.
ZAP was originally forked from Paros, another pentesting proxy. Simon Bennetts, the project lead, stated in 2014 that only 20% of ZAP's source code was still from Paros.
Features
Some of the built in features include:
* An intercepting
proxy server,
* Traditional and
AJAX Web crawler
A Web crawler, sometimes called a spider or spiderbot and often shortened to crawler, is an Internet bot that systematically browses the World Wide Web and that is typically operated by search engines for the purpose of Web indexing (''web spid ...
s
* An automated scanner
* A passive scanner
* Forced browsing
* A
fuzzer
*
WebSocket support
*
Scripting language
A scripting language or script language is a programming language that is used to manipulate, customize, and automate the facilities of an existing system. Scripting languages are usually interpreted at runtime rather than compiled.
A scripting ...
s
* Plug-n-Hack support
It has a plugin-based architecture and an online ‘marketplace’ which allows new or updated features to be added.
The GUI control panel has been described as easy to use.
Awards
* One of the
OWASP tools referred to in the 2015 Bossie award for The best open source networking and security software
* Second place in the Top Security Tools of 2014 as voted by ToolsWatch.org readers
* Top Security Tool of 2013 as voted by ToolsWatch.org readers
* Toolsmith Tool of the Year for 2011
See also
*
Web application security
*
Burp suite
*
W3af
*
Fiddler (software)
References
{{Reflist
External links
Official website
Computer security software
Cross-platform free software
Free security software
Injection exploits
Java platform software
Web security exploits