Secure · DAST
OWASP ZAP
Zed Attack Proxy performs dynamic testing against running web applications: passive scanning of traffic, active attack scans, and API scans from OpenAPI definitions. Automatable via the Docker packaged scans.
On this page
What it does
ZAP proxies and spiders an application, passively flags issues in responses (headers, cookies, information leakage) and can actively probe
for injection, XSS and misconfiguration. The zap-baseline.py, zap-full-scan.py and zap-api-scan.py wrappers make it CI-friendly.
Where it fits
Secure stage against an ephemeral test environment, or Protect as a scheduled scan against staging. Never point an active scan at production without agreement.
Quick start
docker run --rm -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py -t https://staging.example.com -r report.html
docker run --rm -t ghcr.io/zaproxy/zaproxy:stable zap-api-scan.py -t https://staging.example.com/openapi.json -f openapiCommon pitfalls
- Baseline scans are passive; “no findings” does not mean no vulnerabilities.
- Authenticated scanning needs a context file or scripted login — unauthenticated scans miss most of the application.
- Active scans generate real traffic and data; run them against disposable environments.