OWASP ZAP
Free, full-featured web app scanner & proxy.
KaliParrotmedium
pkg: zaproxy
OWASP ZAP is an open-source intercepting proxy with automated scanning, fuzzing and an API for CI.
Syntax
zaproxy (GUI) | zap.sh -cmd
Example
zap.sh -cmd -quickurl https://example.com -quickout zap.html
Runs an automated baseline scan and writes an HTML report.
Advantages
- Powerful and 100% free
- Automation/API for CI
Disadvantages
- Active scan is intrusive
- Heavier UI
Tags
#web#proxy#scanner
Official docs: OWASP ZAP ↗
Related commands
Frequently asked questions
What is OWASP ZAP used for?
OWASP ZAP is an open-source intercepting proxy with automated scanning, fuzzing and an API for CI.
What is an example OWASP ZAP command?
A common example is: zap.sh -cmd -quickurl https://example.com -quickout zap.html — Runs an automated baseline scan and writes an HTML report.
Is OWASP ZAP part of Kali Linux?
Yes. OWASP ZAP ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install zaproxy.
What category of security tool is OWASP ZAP?
OWASP ZAP is a Web Application tool with a medium-risk profile when run against a live target.
Try recon tools live
Run real scans against a domain you control, stage by stage.