zaproxy/zaproxy
Zaproxy
OWASP ZAP is a dynamic application security testing tool and intercepting HTTP proxy used to find vulnerabilities in web applications. It functions as a penetration testing framework that enables both automated security scanning and manual security testing of running web services.
The tool provides a suite of capabilities for analyzing web applications from the outside in, including the ability to capture and modify traffic between a browser and a target application. It is designed to integrate into DevSecOps pipelines to provide consistent security checks across different environments.
Features
- Traffic Interception and Modification - Provides a proxy for capturing, redirecting, and actively altering network requests and responses in transit.
- Web Application Security - Provides tools for testing, verifying, and scanning web applications and APIs for security vulnerabilities.
- Web Security Testing - Provides automated scanning and auditing of web applications for common vulnerabilities.
- Web Vulnerability Scanning - Identifies security weaknesses in web applications through automated vulnerability scanning.
- Traffic Proxying - Acts as an intercepting proxy to capture and modify network traffic between a browser and a web application.
- Application Surface Mapping - Builds a hierarchical model of target applications by discovering links and endpoints through spidering.
- Dynamic Application Security Testing - Analyzes running web applications to identify security flaws that only appear during execution.
- Passive Analysis Pipelines - Monitors existing traffic flows in the background to identify security flaws without altering requests.
- Penetration Testing Frameworks - Provides a comprehensive framework for automating the discovery and exploitation of web security weaknesses.
- Security Analysis Tools - Performs automated inspection of traffic and application behavior to identify potential security weaknesses.
- Security Testing Tools - Ships a specialized set of tools to actively probe and exploit vulnerabilities for professional penetration testing.
- Web Application Penetration Testing - Enables systematic identification and validation of security flaws in web services through manual probing.
- Active Scanning Engines - Implements an active scanning engine that sends malicious payloads to identify web vulnerabilities.
- Pipeline Security - Integrates automated vulnerability scanning directly into CI/CD deployment workflows.
- Session State Simulation - Simulates verified sessions by maintaining and injecting authentication tokens and cookies during scans.
- Plugin-Based Architectures - Utilizes a plugin-based architecture to allow extending core functionality with new security tests and toolsets.
- Containerized Security Environments - Docker image for the OWASP Zed Attack Proxy
- Vulnerability Environments - Automated web application security testing proxy.
- API Testing and Validation - Automated scanner for identifying security vulnerabilities in APIs.
- Security Frameworks - Core project for automated web application security testing.
- Web Security Tools - Integrated penetration testing tool for finding web vulnerabilities.
- Dynamic Analysis - Open-source web application vulnerability scanner with CI/CD support.
- General Web Scanners - Industry-standard intercepting proxy and automated vulnerability scanner.
- Security and Encryption - Performs integrated web application penetration testing.
- Security Auditing - Web application security testing and vulnerability scanning proxy.
- Security Testing - Intercepting proxy for HTTP manipulation and security scanning.
- Traffic Interception - Manipulator-in-the-middle proxy for web security testing.
- Traffic Proxying and Interception - Core OWASP project for web application security testing.
- Vulnerability Scanners - Popular open-source web security testing tool.
