Zed Attack Proxy (ZAP)

ZAP is a free, open source tool for testing the security of web applications. It sits between your browser and a site, so you can inspect and test the traffic that passes through.

ZAP records the requests and responses that pass between a browser and a web application. It can run automated scans that look for common web security problems, and it lets testers edit and resend requests by hand. Scripted automation lets teams run the same checks on a schedule or inside a build.

• Intercept and inspect web traffic
• Run automated scans of web applications
• Edit and resend requests by hand
• Automate checks with scripts
• Add extra features from the community marketplace

Security testers and penetration testers working on web applications are the core audience. Developers who want to check their own apps, and QA teams adding security checks to their process, will also find it useful. Beginners can start with the quick start guide.

ZAP is free and released under the Apache-2.0 license. It is an independent open source project that anyone can contribute to. Test only the sites you have permission to test, because scanning systems you do not own can be illegal.