Description
Before launch you want to check your site for SQL injection, XSS and other common flaws. Commercial scanners cost money and testing by hand is slow.
ZAP (Zed Attack Proxy) is the open source web application scanner maintained under Checkmarx. Enter a URL and run an automated scan: it crawls the site, sends probes and collects findings in the Alerts tab. For a closer look, browse the site through its proxy and inspect every request and response.
Automated scan: passive and active vulnerability checks from just a target URL.
Manual explore: browse through the proxy and review requests, responses and discovered pages.
Graded alerts: risks grouped by category so you can prioritise fixes.
Automation: Docker scans and GitHub Actions bring security testing into CI.
Note: it is a black-box assessment and penetration testing tool, not a source code reviewer.
ZAP (Zed Attack Proxy) is the open source web application scanner maintained under Checkmarx. Enter a URL and run an automated scan: it crawls the site, sends probes and collects findings in the Alerts tab. For a closer look, browse the site through its proxy and inspect every request and response.
Features
Automated scan: passive and active vulnerability checks from just a target URL.
Manual explore: browse through the proxy and review requests, responses and discovered pages.
Graded alerts: risks grouped by category so you can prioritise fixes.
Automation: Docker scans and GitHub Actions bring security testing into CI.
Note: it is a black-box assessment and penetration testing tool, not a source code reviewer.
