ZAP (Zed Attack Proxy) is a
dynamic application security testing
Dynamic application security testing (DAST) represents a non-functional testing process to identify security weaknesses and vulnerabilities in an application. This testing process can be carried out either manually or by using automated tools. Manu ...
tool published under the
Apache License
The Apache License is a permissive free software license written by the Apache Software Foundation (ASF). It allows users to use the software for any purpose, to distribute it, to modify it, and to distribute modified versions of the software ...
. When used as a
proxy server it allows the user to manipulate all of the traffic that passes through it, including
HTTPS
Hypertext Transfer Protocol Secure (HTTPS) is an extension of the Hypertext Transfer Protocol (HTTP). It uses encryption for secure communication over a computer network, and is widely used on the Internet. In HTTPS, the communication protoc ...
encrypted traffic. It can also run in a
daemon
A demon is a malevolent supernatural being, evil spirit or fiend in religion, occultism, literature, fiction, mythology and folklore.
Demon, daemon or dæmon may also refer to:
Entertainment Fictional entities
* Daemon (G.I. Joe), a character ...
mode which is then controlled via a
REST
REST (Representational State Transfer) is a software architectural style that was created to describe the design and guide the development of the architecture for the World Wide Web. REST defines a set of constraints for how the architecture of ...
-based
API
An application programming interface (API) is a connection between computers or between computer programs. It is a type of software interface, offering a service to other pieces of software. A document or standard that describes how to build ...
.
History
ZAP was originally forked from Paros which was developed by Chinotec Technologies Company. Simon Bennetts, the project lead, stated in 2014 that only 20% of ZAP's source code was still from Paros.
The first release was announced on
Bugtraq
Bugtraq was an electronic mailing list dedicated to issues about computer security. On-topic issues are new discussions about vulnerabilities, vendor security-related announcements, methods of exploitation, and how to fix them. It was a high-volume ...
in September 2010, and became an
OWASP
The Open Worldwide Application Security Project (formerly Open Web Application Security Project) (OWASP) is an online community that produces freely available articles, methodologies, documentation, tools, and technologies in the fields of Io ...
project a few months later. In 2023, ZAP developers moved to the
Linux Foundation
The Linux Foundation (LF) is a non-profit organization established in 2000 to support Linux development and open-source software projects.
Background
The Linux Foundation started as Open Source Development Labs in 2000 to standardize and prom ...
, where they became a part of the Software Security Project. As of September 24, 2024, all of the main developers joined
Checkmarx as employees and ZAP was rebranded as ZAP by Checkmarx.
ZAP was listed in the 2015
InfoWorld
''InfoWorld'' (''IW'') is an American information technology media business. Founded in 1978, it began as a monthly magazine. In 2007, it transitioned to a Web-only publication. Its parent company is International Data Group, and its sister pu ...
Bossie award for The best open source networking and security software.
Features
Some of the built in features include:
* An intercepting
proxy server,
* Traditional and
AJAX
Ajax may refer to:
Greek mythology and tragedy
* Ajax the Great, a Greek mythological hero, son of King Telamon and Periboea
* Ajax the Lesser, a Greek mythological hero, son of Oileus, the king of Locris
* Ajax (play), ''Ajax'' (play), by the an ...
Web crawler
Web crawler, sometimes called a spider or spiderbot and often shortened to crawler, is an Internet bot that systematically browses the World Wide Web and that is typically operated by search engines for the purpose of Web indexing (''web spider ...
s
* An automated scanner
* A passive scanner
* Forced browsing
* A
fuzzer
In programming and software development, fuzzing or fuzz testing is an automated software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program. The program is then monitored for exception ...
*
WebSocket
WebSocket is a computer communications protocol, providing a full-duplex, simultaneous two-way communication channel over a single Transmission Control Protocol (TCP) connection. The WebSocket protocol was standardized by the Internet Engineering ...
support
*
Scripting language
In computing, a script is a relatively short and simple set of instructions that typically automation, automate an otherwise manual process. The act of writing a script is called scripting. A scripting language or script language is a programming ...
s
* Plug-n-Hack support
See also
*
Web application security
Application security (short AppSec) includes all tasks that introduce a secure software development life cycle to development teams. Its final goal is to improve security practices and, through that, to find, fix and preferably prevent security is ...
*
Burp suite
Burp Suite is a proprietary software tool for Information technology security assessment, security assessment and penetration testing of web applications. It was initially developed in 2003-2006 by Dafydd Stuttard to automate his own security tes ...
*
W3af
w3af (Web Application Attack and Audit Framework) is an open-source web application security scanner. The project provides a vulnerability scanner and exploitation tool for Web applications. It provides information about security vulnerabilit ...
*
Fiddler (software)
Further reading
*
References
{{Reflist
External links
Official website
Computer security software
Cross-platform free software
Free security software
Java platform software