OWASP ZAP Web Scanner

Find web application vulnerabilities with OWASP ZAP, the leading open-source DAST scanner. Configure baseline and active scans, write scan policies, catch OWASP Top 10 issues like XSS, SQL injection, and CSRF, and integrate automated security testing into CI/CD.

OWASP ZAP (Zed Attack Proxy) is a dynamic application security testing tool for finding runtime vulnerabilities in web apps you own. This skill helps you run baseline and full active scans, tune scan policies to cut false positives, authenticate scans against protected areas, and add zap-baseline to CI pipelines.

When to use

Use for dynamic security testing of your own web applications — running baseline or active scans, tuning scan policies, and integrating OWASP Top 10 checks into CI/CD.

Examples

Run a baseline scan

Quick passive DAST pass

Set up an OWASP ZAP baseline scan against my web app and summarize the OWASP Top 10 findings

Authenticated active scan

Scan behind a login

Configure a ZAP active scan that authenticates with a session token so it can test protected pages

Add ZAP to CI

Gate deploys on DAST results

Add a zap-baseline scan to my GitHub Actions workflow and fail on high-risk alerts