OWASP ZAP Security Scanner

OWASP ZAP (Zed Attack Proxy) is a free and open-source web application security scanner, maintained by the Open Worldwide Application Security Project (OWASP), a nonprofit foundation dedicated to software security. Originally created by Simon Bennetts (psiinon) at Checkmark (formerly Meld Solutions) in 2010 as a fork of the Paros Proxy, ZAP has become one of the most popular web security testing tools in the world, used by penetration testers, developers, and security teams. ZAP was awarded the OWASP Lifetime Achievement Award. Key features: automated scanner: ZAP automatically crawls web applications, identifies vulnerabilities, and reports findings with severity ratings. The active scanner sends crafted payloads to test for vulnerabilities, while the passive scanner analyzes traffic without modifying requests. Vulnerability detection: scans for OWASP Top 10 vulnerabilities including SQL injection (error-based, blind, time-based), cross-site scripting (XSS: reflected, stored, DOM-based), cross-site request forgery (CSRF), insecure direct object references (IDOR), security misconfigurations, broken authentication, and sensitive data exposure. Intercepting proxy: ZAP sits between the browser and the web server, intercepting and modifying HTTP/HTTPS requests and responses in real-time. SSL/TLS interception via dynamically generated certificates. Breakpoints: pause and modify requests/responses for manual testing. Fuzzer: built-in fuzzer for sending multiple variations of input payloads to test endpoints. AJAX spider: headless browser crawler that executes JavaScript to discover dynamically generated content. API: REST API for automation and CI/CD integration. Authentication: supports form-based, HTTP, script-based, and JSON authentication. Contexts: define application scope, users, and session management. Add-ons: marketplace with over 50 community add-ons. Cross-platform (Java). Apache-2.0.