psiinon edited this page Jan 13, 2016 · 9 revisions
Clone this wiki locally

The OWASP Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications.

It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing as well as being a useful addition to an experienced pen testers toolbox.

Interested in a ZAP talk or training event? See the talks page. Not one near you? Contact a ZAP Evangelist to arrange one!

Want a very quick introduction to ZAP? See the project pamphlet.

For a slightly longer introduction see the project presentation.

For video introductions to ZAP see the links on the wiki videos page.

We recently asked our users for feedback about ZAP, you can see their responses (which are separate for each languages) here: English, French, Spanish, Arabic

ZAP provides automated scanners as well as a set of tools that allow you to find security vulnerabilities manually.

Some of ZAP's functionality:

Some of ZAP's features:

  • Open source
  • Cross platform
  • Easy to install (just requires java 1.7)
  • Completely free (no paid for 'Pro' version)
  • Ease of use a priority
  • Comprehensive help pages
  • Fully internationalized
  • Translated into a dozen languages
  • Community based, with involvement actively encouraged
  • Under active development by an international team of volunteers

It supports the following languages:

  • English
  • Arabic
  • Albanian
  • Bosnian
  • Brazilian Portuguese
  • Chinese
  • Danish
  • Filipino
  • French
  • German
  • Greek
  • Indonesian
  • Italian
  • Japanese
  • Korean
  • Persian
  • Polish
  • Russian
  • Spanish
  • Urdu
    To help translate ZAP go to

<wiki:gadget url="\_factoids\_stats.xml" height="270" width="400" border="1"/>

ZAP is a fork of the well regarded Paros Proxy.
Details of the changes made are here: Releases