Web Security Testing with OWASP ZAP

What ZAP is

ZAP (Zed Attack Proxy) is an open-source web application security scanner and proxy maintained by the ZAP community. It sits between your browser and a site, records traffic and can scan for common issues. Read the tool page for links.

Use a safe target

Never scan sites you do not own. Start a deliberately vulnerable app locally, for example OWASP Juice Shop:

docker run --rm -p 3000:3000 bkimminich/juice-shop

Open http://localhost:3000 to confirm it runs. This setup is part of a safe home lab.

Passive vs active scanning

Quick baseline scan

ZAP provides ready-made Docker scripts. A baseline scan spiders the site briefly and reports passive findings:

docker run --rm -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py -t http://host.docker.internal:3000

On Linux you may need the host's IP address instead of host.docker.internal. Check the ZAP documentation for the current image name and options.

Reading alerts

Each alert gives a risk level, a description, the affected URL and a fix suggestion. Treat results as leads to verify: scanners produce false positives and miss logic flaws such as broken access control (see web application security fundamentals).

Workflow

1. Explore the app manually through the ZAP proxy.
2. Run the spider, then a passive scan.
3. In your lab, try an active scan and compare findings.
4. Fix or document each issue and re-scan.

For manual testing continue with Burp Suite basics, and map findings to the OWASP Top 10.