21. Web Application Testing Tools
21.4 OWASP ZAP: A Free Full Scanner
OWASP ZAP (Zed Attack Proxy) is a free, open-source tool that does what Burp does and adds an easy automated scanner at no cost. Good for a quick first pass.
zaproxy # start the GUI (ships with Kali)
- Quick Start, Automated Scan: enter
http://192.168.56.20/dvwa/, and ZAP spiders the site then runs active checks. - Alerts tab: findings sorted by risk (High/Medium/Low), each with a description and a fix.
- ZAP can also be a manual proxy just like Burp.
Burp vs ZAP:
| Burp Community | OWASP ZAP | |
|---|---|---|
| Cost | Free (Pro is paid) | Fully free |
| Automated active scan | Pro only | Yes, free |
| Manual proxy/repeater | Yes | Yes |
| Best for | Careful manual testing | Quick automated pass + manual |
Ravindra Bagale's Tip
ZAP cha automated scan sopa aahe mhanun students tyalach "pentest" samajtat. Automated scan fakt suruvat aahe – khare bugs (business logic, IDOR) manual proxy nech miltat. Doni vaparaa: ZAP ne quick pass, mag Burp ne manual dig.
Lab
Run a ZAP automated scan against DVWA. Export the alert report. Pick one High alert, then reproduce it manually in Burp Repeater to confirm it is real.