OWASP ZAP

About OWASP ZAP

OWASP ZAP (Zed Attack Proxy) is a security testing tool with a REST API documented for Python, Java, and shell clients. The API exposes functionality for spidering and Ajax spidering web applications, running passive and active security scans, retrieving scan results and alerts, and handling authentication (form-based, script-based, and JSON-based) against target applications.

The reference documentation covers configuration of spider and scan settings, access control testing, anti-CSRF token handling, alert management and filtering, scan policy management, break points for intercepting HTTP messages, authorization detection methods, and automation plan execution. It is intended for developers and security testers who want to script or integrate ZAP's application security testing capabilities programmatically rather than through its graphical interface.

Key features

• Automated web application spider and Ajax spider crawling
• Passive and active vulnerability scanning
• Access control testing and reporting
• Anti-CSRF token detection and management
• Authentication and authorization configuration for scans
• REST-style API with Python, Java, and shell client support

Frequently asked questions