Skip to content
Vol. 1 · Ed. 2026
CyberGlossary
English
Entry № 880

OWASP ZAP

Reviewed byCybersecurity entrepreneur & security researcher

What is OWASP ZAP?

OWASP ZAPZed Attack Proxy, an open-source web application security testing tool originally from OWASP and now stewarded by Checkmarx and the ZAP community.

OWASP Zed Attack Proxy (ZAP) is an open-source dynamic application security testing (DAST) tool that acts as an intercepting proxy, automated scanner, and fuzzer for web applications and APIs. First released by Simon "psiinon" Bennetts in 2010 as a fork of the Paros Proxy, it grew into one of OWASP's flagship projects.

ZAP works by sitting between the tester's browser and the target: it spiders the app to enumerate URLs, replays each request through passive scanning (inspecting responses for issues like missing security headers or insecure cookie flags), then runs active scanning rules that inject payloads to probe for SQL injection, cross-site scripting, path traversal, and more. Findings map to CWE and WASC identifiers. Automation is exposed through the ZAP API, a scriptable engine (JavaScript, Python via Jython, Zest), and packaged Docker actions such as the baseline and full-scan jobs used in CI.

In September 2024 the three core maintainers (Bennetts, Ricardo Pereira, and Rick Mitchell) joined Checkmarx, which now employs them to work on the project, rebranded ZAP by Checkmarx. ZAP stays free and open source under the Apache License 2.0, controlled by the ZAP Core Team. Compared with Burp Suite, ZAP trades some polish for zero licensing cost and first-class scriptability, making it a common choice for pipeline DAST.

flowchart LR
  T[Tester / CI job] --> P[ZAP proxy]
  P --> S[Spider & AJAX crawl]
  S --> PA[Passive scan<br/>headers, cookies]
  S --> AC[Active scan<br/>inject payloads]
  PA --> R[Alerts mapped to CWE]
  AC --> R
  P --> APP[(Target web app / API)]
  APP --> P

● Examples

  1. 01

    Running a ZAP baseline scan in a GitHub Actions workflow to flag obvious misconfigurations on every pull request.

  2. 02

    Using the ZAP HUD to intercept and modify a GraphQL request during a manual pentest.

● Frequently asked questions

What is OWASP ZAP?

Zed Attack Proxy, an open-source web application security testing tool originally from OWASP and now stewarded by Checkmarx and the ZAP community. It belongs to the Compliance & Frameworks category of cybersecurity.

What does OWASP ZAP mean?

Zed Attack Proxy, an open-source web application security testing tool originally from OWASP and now stewarded by Checkmarx and the ZAP community.

How do you defend against OWASP ZAP?

Defences for OWASP ZAP typically combine technical controls and operational practices, as detailed in the full definition above.

What are other names for OWASP ZAP?

Common alternative names include: Zed Attack Proxy, ZAP.

● Related terms