OWASP ZAP w2021-10-25 released: pentesting tool for finding vulnerabilities in web applications
The OWASP Zed Attack Proxy (ZAP) is easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing as well as being a useful addition to an experienced pen testers toolbox.
ZAP provides automated scanners as well as a set of tools that allow you to find security vulnerabilities manually.
Some of ZAP’s features:
- Open source
- Cross-platform
- Easy to install (just requires java 1.7)
- Completely free (no paid for ‘Pro’ version)
- Ease of use a priority
- Comprehensive help pages
- Fully internationalized
- Translated into a dozen languages
- Community-based, with involvement, actively encouraged
- Under active development by an international team of volunteers
Some of ZAP’s functionality:
- Intercepting Proxy
- Traditional and AJAX spiders
- Automated scanner
- Passive scanner
- Forced browsing
- Fuzzer
- Dynamic SSL certificates
- Smartcard and Client Digital Certificates support
- Web sockets support
- Support for a wide range of scripting languages
- Plug-n-Hack support
- Authentication and session support
- Powerful REST-based API
- Automatic updating option
- Integrated and growing marketplace of add-ons
OWASP ZAP v2.11.0 has been released.
Changelog
Alert Tags
Alerts can now be tagged with arbitrary keys or key=value pairs.
The active and passive scan rules have been updated to include tags for the OWASP Top 10 2021 and 2017 – these are also now shown on the website Alert Details pages.Automation Framework
The Automation Framework is a new way to automate ZAP and is expected to become the default option for most use cases. For more details see the Automation Framework page on the website.
Report Generation
The new Report Generation add-on allows you to generate much more flexible reports with access to much more data. The previous reporting add-ons have been removed from the marketplace as they provide less functionality and are no longer maintained.
New report templates include:
- Risk and Confidence HTML – the new default report
- Modern HTML Report with themes and options
- High Level Report Sample
- Traditional HTML Report with requests and responses
“Traditional” templates have been added which match the old reports for anyone who relies on their formats.
OAST Support
The new OAST Support add-on allows you to find and exploit out-of-band vulnerabilities. This add-on is alpha at the time of the 2.11.0 release but is expected to be updated soon, so check the help pages for the latest features.
More…
Download
OWASP ZAP Tutorial
