Learn
LoginRegister
← All tools

OWASP ZAP

Tool manual · Kali & common usage

Web testing · Beginner · Web testing lane

BeginnerWeb Proxy
Authorized usage only. Capture and inspect traffic only on systems and networks you own or have written permission to analyze.

What is OWASP ZAP?

OWASP ZAP is a free intercepting proxy and DAST scanner for finding web vulnerabilities.

Explore apps manually or run automated baseline/full scans against lab targets and CI pipelines.

Official website: OWASP ZAP · Documentation

When do you use it?

  • Open-source alternative/complement to Burp for DAST.
  • CI baseline scan against a staging URL you own.

When not to use it

  • Active scan without authorization can harm production.

Who uses it?

  • AppSec engineers
  • Bug bounty hunters (in-scope)
  • Penetration testers

How do you use it? (typical flow)

  1. Install OWASP ZAP using the steps below (prefer Kali package or official installer).
  2. Confirm you have authorization for the target (lab VM, own system, or written scope).
  3. Run --help / man (or the Help section) to see current flags for your version.
  4. Start with a safe example from Basic commands against localhost or an authorized lab target.
  5. Record what you ran, what you observed, and any follow-up (filter, report, remediation).

Help & manual (like man / --help)

Every serious tool has a built-in way to look up flags. Learn these first so you are not stuck memorizing every option.

  1. 1. Docs

    https://www.zaproxy.org/docs/

    User guide and API.

  2. 2. CLI help

    zap.sh -help

    When using desktop script wrappers.

Kali Linux

Install via Kali packages or download from zaproxy.org. Also popular as Docker image.

1. Installation

OSInstallation
Kali LinuxInstall via Kali packages or download from zaproxy.org. Also popular as Docker image.
All platformsDownload from zaproxy.org
Dockerdocker run -t zaproxy/zap-stable zap-baseline.py -t http://localhost:3000

2. Basic commands

  1. 1. Scan your local Juice Shop instance

    Automated Scan → http://localhost:3000

    Scan your local Juice Shop instance

  2. 2. Show help

    Automated --help

    List flags for your installed version (same habit as man/--help).

  3. 3. Short help

    Automated -h

    Alternate help flag when supported.

  4. 4. Non-intrusive analysis

    Passive scan

    Non-intrusive analysis

  5. 5. Sends attack payloads — lab only

    Active scan

    Sends attack payloads — lab only

  6. 6. Define scope

    Contexts

    Define scope

Options / flags

OptionPurpose
Passive scanNon-intrusive analysis
Active scanSends attack payloads — lab only
ContextsDefine scope

5. Useful features

  • Manual explore
  • Spidering
  • Passive vs active scan
  • Automation framework

6. Practical examples

  1. Example 1: Scan your local Juice Shop instance

    Automated Scan → http://localhost:3000

    Scan your local Juice Shop instance

  2. Example 2: Show help

    Automated --help

    List flags for your installed version (same habit as man/--help).

  3. Example 3: Short help

    Automated -h

    Alternate help flag when supported.

  4. Example 4: Non-intrusive analysis

    Passive scan

    Non-intrusive analysis

  5. Example 5: Sends attack payloads — lab only

    Active scan

    Sends attack payloads — lab only

7. Important notes

  • Frequently used in CI pipelines for automated DAST.
  • Authorized targets only — labs, systems you own, or written permission.
  • Prefer reading --help / man / official docs for your installed version; flags change over time.

Related course: web application security · bug bounty hunting · Commands: /commands#burp