Skip to main content

Want to Practice These Techniques?

Try Hackviser's interactive cyber security upskilling platform - Learn by doing!

Start Practicing Now

OWASP ZAP

What is the purpose of OWASP ZAP?​

OWASP ZAP, also known as Zed Attack Proxy, is an open-source web application security testing tool. It works as an intercepting proxy for manual testing and also provides automated passive scanning, active scanning, crawling, API testing, reporting, and CI/CD-friendly automation.

ZAP is especially useful for web application assessments because it can sit between a browser and the target application, observe traffic, identify security issues, and automate repeatable dynamic application security testing workflows.

Here are the primary uses of OWASP ZAP:

  • Intercepting Proxy Testing: ZAP proxies browser traffic so testers can inspect, modify, replay, and analyze HTTP and HTTPS requests during manual web application testing.

  • Passive Security Scanning: The tool reviews observed traffic without sending attack payloads, making it useful for early feedback, CI checks, and safer baseline analysis.

  • Active Vulnerability Scanning: ZAP can actively test discovered URLs and parameters for common web vulnerabilities. Active scanning can change application state, so it should be used only on owned or explicitly authorized targets.

  • Application Crawling: ZAP can discover application paths with the traditional spider and the AJAX spider, which is useful for modern JavaScript-heavy applications.

  • API Security Testing: The tool can import API definitions such as OpenAPI, SOAP, and GraphQL sources, then scan the discovered endpoints.

  • CI/CD Automation: ZAP supports Docker scan scripts and the Automation Framework, allowing teams to run repeatable web security checks in pipelines.

  • Reporting and Triage: ZAP produces alerts, risk ratings, evidence, request and response data, and reports that can support vulnerability validation and remediation.

Core Features​

  • Intercepting proxy for manual web testing
  • Passive and active scanning
  • Traditional spider and AJAX spider crawling
  • OpenAPI, GraphQL, and SOAP import workflows
  • Automation Framework and Docker scan scripts
  • Authentication, context, and session handling
  • HTML, JSON, XML, and Markdown reporting

Data sources​

  • HTTP and HTTPS requests and responses
  • Browser proxy traffic, cookies, and sessions
  • Target URLs and spidered paths
  • OpenAPI, GraphQL, and SOAP definitions
  • ZAP contexts, sessions, and automation YAML files
  • Passive and active scan alerts

Common OWASP ZAP Commands​

1. Show ZAP Help​

  • This command displays command-line options for the installed ZAP launcher.
zap.sh -h

2. Show ZAP Version​

  • This command prints the installed ZAP version.
zap.sh -version

3. Start ZAP Desktop​

  • This command starts the graphical ZAP desktop application.
zap.sh

4. Start ZAP in Daemon Mode​

  • This command starts ZAP without the desktop UI and exposes the proxy and API locally.
zap.sh -daemon -host 127.0.0.1 -port 8080

5. Start ZAP Daemon with an API Key​

  • This command starts ZAP in daemon mode and sets an API key for API-controlled workflows.
zap.sh -daemon -host 127.0.0.1 -port 8080 -config api.key=<api_key>

6. Proxy a Request Through ZAP​

  • This command sends a single request through the running ZAP proxy so it can be observed and passively scanned.
curl -x http://127.0.0.1:8080 https://example.com

7. Run a Quick Command-Line Scan​

  • This command runs a quick scan against a target URL and writes an HTML report.
zap.sh -cmd -quickurl https://example.com -quickout zap-quick.html

8. Update ZAP Add-ons​

  • This command updates installed ZAP add-ons from the command line.
zap.sh -cmd -addonupdate

9. Install a ZAP Add-on​

  • This command installs a selected add-on by its add-on ID.
zap.sh -cmd -addoninstall <addon_id>

10. Run a Docker Baseline Scan​

  • This command runs the ZAP baseline scan from Docker. Baseline scans spider the target and run passive checks.
docker run -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py -t https://example.com

11. Save a Docker Baseline HTML Report​

  • This command mounts the current directory and writes the baseline report to a local file.
docker run -t -v $(pwd):/zap/wrk/:rw ghcr.io/zaproxy/zaproxy:stable zap-baseline.py -t https://example.com -r zap-baseline.html

12. Generate a Baseline Scan Configuration File​

  • This command generates a baseline configuration file that can be tuned for future scans.
docker run -t -v $(pwd):/zap/wrk/:rw ghcr.io/zaproxy/zaproxy:stable zap-baseline.py -t https://example.com -g baseline.conf

13. Run a Docker Full Scan​

  • This command runs the full scan script, which crawls the target and performs active scanning.
docker run -t -v $(pwd):/zap/wrk/:rw ghcr.io/zaproxy/zaproxy:stable zap-full-scan.py -t https://example.com -r zap-full.html

14. Run a Full Scan with AJAX Spider​

  • This command enables AJAX spidering for JavaScript-heavy applications during a full scan.
docker run -t -v $(pwd):/zap/wrk/:rw ghcr.io/zaproxy/zaproxy:stable zap-full-scan.py -t https://example.com -j -r zap-full.html

15. Set a Full Scan Time Limit​

  • This command limits the maximum scan duration in minutes.
docker run -t -v $(pwd):/zap/wrk/:rw ghcr.io/zaproxy/zaproxy:stable zap-full-scan.py -t https://example.com -m 20 -r zap-full.html

16. Run an OpenAPI Scan​

  • This command imports an OpenAPI definition and scans the discovered API endpoints.
docker run -t -v $(pwd):/zap/wrk/:rw ghcr.io/zaproxy/zaproxy:stable zap-api-scan.py -t https://example.com/openapi.json -f openapi -r zap-api.html

17. Run a GraphQL API Scan​

  • This command imports a GraphQL endpoint or schema and scans it with the ZAP API scan script.
docker run -t -v $(pwd):/zap/wrk/:rw ghcr.io/zaproxy/zaproxy:stable zap-api-scan.py -t https://example.com/graphql -f graphql -r zap-graphql.html

18. Run an API Scan with a Context File​

  • This command uses a ZAP context file when scanning authenticated or scoped API targets.
docker run -t -v $(pwd):/zap/wrk/:rw ghcr.io/zaproxy/zaproxy:stable zap-api-scan.py -t https://example.com/openapi.json -f openapi -n api.context -r zap-api.html

19. Run an Automation Framework Plan​

  • This command runs a ZAP Automation Framework YAML plan from Docker.
docker run -t -v $(pwd):/zap/wrk/:rw ghcr.io/zaproxy/zaproxy:stable zap.sh -cmd -autorun /zap/wrk/zap.yaml

20. Import an OpenAPI Definition Through the API​

  • This command imports an OpenAPI definition into a running ZAP daemon.
curl "http://127.0.0.1:8080/JSON/openapi/action/importUrl/?url=https://example.com/openapi.json"

21. Start a Spider Scan Through the API​

  • This command starts the traditional spider against a target URL.
curl "http://127.0.0.1:8080/JSON/spider/action/scan/?url=https://example.com"

22. Check Spider Status​

  • This command checks the progress of a spider scan by scan ID.
curl "http://127.0.0.1:8080/JSON/spider/view/status/?scanId=<scan_id>"

23. Start an Active Scan Through the API​

  • This command starts an active scan against a target URL in a running ZAP daemon.
curl "http://127.0.0.1:8080/JSON/ascan/action/scan/?url=https://example.com"

24. Check Active Scan Status​

  • This command checks the progress of an active scan by scan ID.
curl "http://127.0.0.1:8080/JSON/ascan/view/status/?scanId=<scan_id>"

25. Get Alerts Through the API​

  • This command retrieves ZAP alerts for a target URL as JSON.
curl "http://127.0.0.1:8080/JSON/core/view/alerts/?baseurl=https://example.com"

26. Shut Down ZAP Through the API​

  • This command shuts down a running ZAP daemon after an automated workflow completes.
curl "http://127.0.0.1:8080/JSON/core/action/shutdown/"

Output Examples of OWASP ZAP Commands​

CommandExample UsageFunctionOutput Example
Show Helpzap.sh -hDisplays command-line options.Options include -daemon, -cmd, -quickurl, -autorun
Start Daemonzap.sh -daemon -host 127.0.0.1 -port 8080Starts ZAP without the desktop UI.ZAP is now listening on 127.0.0.1:8080
Proxy Requestcurl -x http://127.0.0.1:8080 https://example.comSends traffic through ZAP for inspection.Request appears in Sites tree and passive scan queue
Quick Scanzap.sh -cmd -quickurl https://example.com -quickout zap-quick.htmlRuns a quick command-line scan.Report written to zap-quick.html
Update Add-onszap.sh -cmd -addonupdateUpdates installed add-ons.Add-ons updated successfully
Install Add-onzap.sh -cmd -addoninstall openapiInstalls a selected add-on.Installed add-on: openapi
Baseline Scanzap-baseline.py -t https://example.comCrawls the target and runs passive checks.PASS: X-Content-Type-Options Header Missing
Baseline Reportzap-baseline.py -t https://example.com -r zap-baseline.htmlSaves baseline scan results in HTML.Report saved to /zap/wrk/zap-baseline.html
Generate Configzap-baseline.py -t https://example.com -g baseline.confCreates a scan rule configuration file.Configuration file written to baseline.conf
Full Scanzap-full-scan.py -t https://example.com -r zap-full.htmlRuns spidering and active scanning.Active scan complete. Alerts found: 7
AJAX Full Scanzap-full-scan.py -t https://example.com -j -r zap-full.htmlUses AJAX spidering for dynamic pages.Ajax Spider started
Time-Limited Full Scanzap-full-scan.py -t https://example.com -m 20Limits full scan duration.Maximum scan duration set to 20 minutes
OpenAPI Scanzap-api-scan.py -t https://example.com/openapi.json -f openapiImports and scans API endpoints.Imported OpenAPI definition
GraphQL Scanzap-api-scan.py -t https://example.com/graphql -f graphqlScans a GraphQL API target.GraphQL endpoint imported
Context API Scanzap-api-scan.py -t https://example.com/openapi.json -f openapi -n api.contextUses a scoped or authenticated context.Using context file api.context
Automation Planzap.sh -cmd -autorun /zap/wrk/zap.yamlRuns a repeatable YAML automation workflow.Automation plan completed
Import OpenAPIcurl /JSON/openapi/action/importUrl/Imports an OpenAPI definition into ZAP.{"code":"OK","message":"OK"}
Spider APIcurl /JSON/spider/action/scan/Starts a spider scan through the API.{"scan":"0"}
Spider Statuscurl /JSON/spider/view/status/?scanId=0Checks spider progress.{"status":"100"}
Active Scan APIcurl /JSON/ascan/action/scan/Starts active scanning through the API.{"scan":"1"}
Active Scan Statuscurl /JSON/ascan/view/status/?scanId=1Checks active scan progress.{"status":"100"}
Get Alertscurl /JSON/core/view/alerts/Retrieves alert data as JSON.{"alerts":[{"risk":"Medium","name":"Content Security Policy Header Not Set"}]}
Shutdown APIcurl /JSON/core/action/shutdown/Stops the daemon after automation.ZAP shutdown requested