OWASP ZAP is a free, open-source web application scanner that identifies security flaws by analyzing traffic between browsers and servers. It serves as an essential tool for developers and penetration testers, allowing for both automated vulnerability scanning and manual proxy testing.
- Combines automated scanning with manual proxy tools to identify bugs such as SQL injection.
- Integrates into development pipelines to check software security prior to deployment.
Important Terminologies
- Proxy Server: It is a server that acts as a mediator for clients who want to go through the request and want to alter them.
- Spider: It is a type of information gathering process in which the application in this case ZAP will go through the whole web page and try to find out all the links and other important details.
- Passive Scan: In this type of scanning the vulnerability is detected without getting in direct contact with the target machine.
- Active Scan: In this, the vulnerability is detected by getting in direct contact with the target machine which makes it very easy to be detected by the administrator.
Working Process
First we set up the proxy server with any browser. The browser sends website data to the proxy server and then the browser inside the ZAP process the request and perform attacks and generates the report. 
Â
Configuration Steps
- Step 1: Download ZAP from here, by selecting the proper operating system.
- Step 2: Run the file and follow the instruction until the installation is complete.
Steps to Run:
- Step 1: Open the application through the terminal or by clicking on the icon.
- Step 2: In the next step, select the first option and click start.
- Step 3: Now choose a target to scan and enter its web address in the green highlighted box and click attack.
- Step 4: Now you will have to wait for a few minutes to get the result.
