Ravindra BagaleCourses & study guides मराठी Track your progress

21. Web Application Testing Tools

21.4 OWASP ZAP: A Free Full Scanner

By Last updated:

In short: OWASP ZAP (Zed Attack Proxy) is a free, open-source tool that does what Burp does and adds an easy automated scanner at no cost.

OWASP ZAP (Zed Attack Proxy) is a free, open-source tool that does what Burp does and adds an easy automated scanner at no cost. Good for a quick first pass.

zaproxy        # start the GUI (ships with Kali)
  • Quick Start, Automated Scan: enter http://192.168.56.20/dvwa/, and ZAP spiders the site then runs active checks.
  • Alerts tab: findings sorted by risk (High/Medium/Low), each with a description and a fix.
  • ZAP can also be a manual proxy just like Burp.

Burp vs ZAP:

Burp Community OWASP ZAP
Cost Free (Pro is paid) Fully free
Automated active scan Pro only Yes, free
Manual proxy/repeater Yes Yes
Best for Careful manual testing Quick automated pass + manual

Ravindra Bagale's Tip

ZAP's automated scan is easy, so students think that alone is a "pentest". An automated scan is only the start – real bugs (business logic, IDOR) are found only with a manual proxy. Use both: a quick pass with ZAP, then dig manually with Burp.

Lab

Run a ZAP automated scan against DVWA. Export the alert report. Pick one High alert, then reproduce it manually in Burp Repeater to confirm it is real.

ZAP in a student's weekly routine

ZAP's automated scan is ideal for your own staging app after every feature branch.

  1. Deploy the branch to a private staging URL.
  2. Run a ZAP baseline or full scan.
  3. Fix High findings before merge.
  4. Keep the HTML report next to the release notes.

CI idea

OWASP publishes a ZAP GitHub Action. Many teams fail the build on new High alerts, the same way they fail on red unit tests.

Real examples

Global: OWASP is a non-profit; ZAP is maintained for defenders and testers. Indian company (sample): a Bengaluru SaaS team runs ZAP nightly on staging and opens Jira tickets automatically from High alerts.

Recap

  • Automate ZAP on staging.
  • Own apps only.

Defender's worksheet (do this today)

  1. Write the lesson title and date in your notebook.
  2. List three systems you own (VMs, personal projects, or lab apps) where this lesson applies.
  3. Run one safe command or checklist item from the lesson on a lab system only.
  4. Paste the command and its output under an Evidence heading.
  5. Write one fix you would give a teammate in two sentences.
  6. Write one mistake students make with this topic and how to avoid it.

More real-world pictures

Indian workplace (sample data)

Suppose we are a junior analyst at Tech Mahindra supporting a client SOC. After reading this lesson you add one detection or one hardening item to the team weekly checklist, with the owner name and a due date. That is how learning becomes operations.

Global practice

Public bodies such as CERT-In (India), CISA (US) and NCSC (UK) publish advisories that map to the same ideas: patch, least privilege, logging and user awareness. Bookmark one advisory feed and read it every Monday.

Home and family

Explain this lesson to a family member in four sentences without jargon. If they can repeat the main warning back to you, you understand it well enough to teach.

Connect to earlier chapters

Parts 1 to 9 built Linux, web servers, databases and cloud pieces. This lesson only makes sense when you can point to a concrete config file, package name or architecture box from those parts. If you cannot, revisit the matching earlier chapter before you practise any tool command.

Common mistakes

  • Skipping written permission just for a quick scan.
  • Practising on hostel or office Wi-Fi targets without authorisation.
  • Collecting tool output without writing the fix.
  • Copying exploit commands onto production to verify. Verification for defenders means checking versions and patches, not firing modules.

Recap

  • Evidence, fix, owner, date.
  • Own lab only.
  • Teach one other person the warning from this lesson.