21. Web Application Testing Tools
21.4 OWASP ZAP: A Free Full Scanner
In short: OWASP ZAP (Zed Attack Proxy) is a free, open-source tool that does what Burp does and adds an easy automated scanner at no cost.
OWASP ZAP (Zed Attack Proxy) is a free, open-source tool that does what Burp does and adds an easy automated scanner at no cost. Good for a quick first pass.
zaproxy # start the GUI (ships with Kali)
- Quick Start, Automated Scan: enter
http://192.168.56.20/dvwa/, and ZAP spiders the site then runs active checks. - Alerts tab: findings sorted by risk (High/Medium/Low), each with a description and a fix.
- ZAP can also be a manual proxy just like Burp.
Burp vs ZAP:
| Burp Community | OWASP ZAP | |
|---|---|---|
| Cost | Free (Pro is paid) | Fully free |
| Automated active scan | Pro only | Yes, free |
| Manual proxy/repeater | Yes | Yes |
| Best for | Careful manual testing | Quick automated pass + manual |
Ravindra Bagale's Tip
ZAP's automated scan is easy, so students think that alone is a "pentest". An automated scan is only the start – real bugs (business logic, IDOR) are found only with a manual proxy. Use both: a quick pass with ZAP, then dig manually with Burp.
Ravindra Bagale's Tip – मराठी
ZAP चा automated scan सोपा आहे म्हणून students त्यालाच "pentest" समजतात. Automated scan फक्त सुरुवात आहे – खरे bugs (business logic, IDOR) manual proxy नेच मिळतात. दोन्ही वापरा: ZAP ने quick pass, मग Burp ने manual dig.
Ravindra Bagale's Tip – हिंदी
ZAP का automated scan आसान है, इसलिए students उसी को "pentest" समझ लेते हैं. Automated scan सिर्फ़ शुरुआत है – असली bugs (business logic, IDOR) manual proxy से ही मिलते हैं. दोनों इस्तेमाल करो: ZAP से quick pass, फिर Burp से manual dig.
Lab
Run a ZAP automated scan against DVWA. Export the alert report. Pick one High alert, then reproduce it manually in Burp Repeater to confirm it is real.