ZAP (Zed Attack Proxy)

What it is

ZAP (Zed Attack Proxy) is a free open-source web application security scanner and manipulator-in-the-middle proxy, maintained by the ZAP Core Team with support from Checkmarx, that intercepts browser traffic and runs passive and active checks against web applications. Installers cover Windows, Linux and macOS; Docker images and an automation framework support headless and pipeline use.

What it helps with

- Intercept, inspect and modify HTTP(S) traffic between client and application.
- Spider or explore applications to build a site map for testing.
- Run passive analysis on observed traffic and active scans that send attack payloads.
- Automate scans in CI/CD via the Automation Framework, API and Docker images.
- Extend behaviour with marketplace add-ons and scripts.
- Give developers, QA and testers a free proxy-based DAST option alongside manual testing.

Who it's for

Developers and QA embedding security checks in pipelines, AppSec teams, and penetration testers who want an open-source intercepting proxy and scanner.

Worth knowing

Active scans send attack traffic — use them only against applications you are authorised to test. The project is no longer an OWASP flagship; official branding is “ZAP by Checkmarx” while remaining an independent open-source project under Apache License 2.0 (ownership explained on zaproxy.org/docs/zap-ownership/). Avoid outdated “OWASP ZAP” labelling on new copy.