OWASP ZAP Vulnerability Scanning: Web Application Security Testing Configuration Guide

Automated web app vulnerability scanning with OWASP ZAP: proxy setup, active scan, report export, and false-positive handling. Reproducible commands and config.

Use Cases

OWASP ZAP scanning fits: a fast pre-prod security pass on a web app; continuous automated scanning in dev/test; a free open-source web app tester instead of a paid commercial scanner.

Prerequisites

• Java 8+
• Authorized test permission on the target site
• Network path from the test host to the app

How It Works

OWASP ZAP (Zed Attack Proxy) is an open-source web app scanner. It sits as a local proxy, intercepts browser↔site HTTP/HTTPS, spiders plus passive-scans to map the site, then active-scans with crafted requests. Matches response fingerprints for SQL injection, XSS, path traversal, command injection, and similar rules. Versus Burp Suite, ZAP is stronger on automation. Docker image and REST API exist for CI/CD.

Procedure

Step 1: Install and start ZAP

# Download, unpack, launch desktop
wget https://github.com/zaproxy/zaproxy/releases/download/v2.16.1/ZAP_2_16_1_unix.sh
bash ZAP_2_16_1_unix.sh -c
# Or Docker daemon mode
docker run -u zap -p 8080:8080 -i ghcr.io/zaproxy/zaproxy zap.sh -daemon -port 8080

Step 2: Point the browser at the proxy and browse the target

Set browser proxy to 127.0.0.1:8080. Install the ZAP CA into the browser trust store so HTTPS decrypts. Manually walk core pages. ZAP passive-scan collects parameters and endpoints.

Step 3: Run an active scan

# UI: right-click site -> Attack -> Active Scan
# Or CLI against a URL
zap.sh -cmd -quickurl https://target.example.com   -quickout report.html -quickprogress

Step 4: Export the report

After the scan, Report menu → HTML or PDF. Findings ranked High/Medium/Low/Informational, with request/response samples and fix notes. Use as the assessment deliverable.

Verification

Report contains at least one real finding on the target. Each alert includes full request and response for manual review. False positives: mark via `Flag as False Positive` and exclude.

FAQ

Q1: Scan is drowning in false positives?

Check whether the request/response actually shows a harmful pattern, then apply business logic. Right-click alert → false positive. Context config can exclude parameters or paths so they don't re-alert.

Q2: ZAP in CI/CD?

Official `zap-full-scan.py` and GitHub Action. Pass target URL, rule set, report path. Pipeline runs the scan, uploads the report, fails the build on High findings.

Q3: Site has login; scanner never sees post-auth pages?

Log in through the proxied browser first. ZAP records the session cookie. In site context, mark that cookie as session management and configure form-based login. Active scan then sends the session token to protected pages.

Summary

OWASP ZAP: proxy capture + active scan. Free, workable automated web scanning. Pair with report export and CI/CD. Catches SQL injection, XSS, and similar pre-prod. High value in the test toolbox.