Zed Attack Proxy

OWASP Zed Attack Proxy (ZAP) is an open-source web application security testing tool developed by the OWASP community.

It is designed to identify vulnerabilities such as SQL injection, cross-site scripting (XSS), and CSRF in web applications.

ZAP works as a “man-in-the-middle” proxy, intercepting traffic between the browser and web server to analyze potential security risks. It offers both automated scanning and manual testing features, making it suitable for beginners and experienced security professionals.

ZAP is widely used in development environments for continuous security testing and integrates seamlessly with CI/CD pipelines to support DevSecOps practices.