security enabled verified medium v1.0.0

owasp-zap

OWASP Zed Attack Proxy — open-source web application security scanner for finding vulnerabilities in web applications and APIs.

📋 Live Preview

zap -daemon -port {port} -host {host}

🌍 port → 8080 🌍 host → 127.0.0.1

zap -daemon -port {port} -host {host}

Sandbox: execFile · Timeout: 3600s

Capabilities

web.proxy.intercept

web.scan.active

web.scan.passive

web.fuzzing

web.spider

web.api.scan

web.session.handling

Parameters

Name	Type	Required	Default	Description	Aliases
`daemon`	boolean	No	-	Run ZAP in daemon mode (headless)	`-daemon`
`port`	integer	No	8080	Port to listen on (default 8080)	`-port`
`host`	string	No	127.0.0.1	Host address to bind to (default 127.0.0.1)	`-host`
`config`	string	No	-	Configuration key=value pairs	`-config`
`cmd`	boolean	No	-	Run ZAP in command-line mode without GUI	`-cmd`
`suppressinfo`	boolean	No	-	Suppress informational messages in output	`-suppressinfo`
`newsession`	string	No	-	Create new session at specified path	`-newsession`
`session`	string	No	-	Open existing session file	`-session`
`h`	boolean	No	-	Show this help message	`-h`, `-help`

Artifacts

Type	Description	MIME	Schema	Trust
`web.scan.report`	ZAP scan report in HTML or JSON	text/html	-	verified
`web.scan.session`	ZAP session file	application/octet-stream	-	verified

Contract

Inputs

web.target.url

Target application URL to scan

web.target.context

Context definition for authenticated scanning

Outputs

web.scan.report

HTML or JSON scan report

web.scan.alerts

Security alerts found during scan

Side effects: network_trafficnetwork_traffic

Workflow Edges

Produces

web.scan.reportweb.scan.alerts

Consumes

web.target.urlweb.target.context

Resource Profile

Resource	Value
CPU	high
Memory	512 MB
Network	medium
Disk I/O	low

Examples

Start ZAP in daemon mode on default port

zap -daemon -port 8080

Run ZAP in command-line mode with config

zap -cmd -config api.disablekey=true

Start daemon with custom host binding

zap -daemon -host 0.0.0.0 -port 9090

Load existing session and suppress info messages

zap -session session.session -suppressinfo

Create new session in daemon mode

zap -daemon -newsession /tmp/zap-session

Full automated scan using zap-cli

zap-cli --port 8080 quick-scan --self-contained -r report.html https://target.com

Documentation

OWASP ZAP — Zed Attack Proxy

OWASP ZAP (Zed Attack Proxy) is one of the world's most popular free web application security scanners. It helps automatically find security vulnerabilities in web applications and APIs.

Key Features

Intercepting Proxy: Inspect and modify HTTP/HTTPS traffic
Active Scanner: Automatically find vulnerabilities
Passive Scanner: Identify issues without modifying requests
Spider: Crawl web applications to map content
API Scanning: Test REST and GraphQL APIs
Authentication Support: Form-based, NTLM, OAuth, etc.

Modes

Mode	Command	Description
GUI	`zap`	Standard graphical interface
Daemon	`zap -daemon`	Headless mode (API accessible)
Command-line	`zap -cmd`	CLI mode for scripting

Basic Usage

# Start daemon mode for automated scanning
zap -daemon -port 8080

# Use zap-cli for headless scanning
zap-cli --port 8080 quick-scan -r report.html https://target.com

# Run with custom configuration
zap -cmd -config api.disablekey=true -config scanner.attackOnStart=true