OWASP ZAP

6.9easy start · #11 of 35
in Penetration Testing Software

Free to practise onyes
Free trialnot on record
Well documentedyes
Runs where you workyes

Runs on api, Linux, Mac, self-hosted, Windows.

OWASP ZAP is ranked #11 of 35 in penetration testing software on The Geeks Club. It runs on API, Linux, macOS, Self-hosted, Windows. There is a free plan.

OWASP ZAP plans and pricing

All plans

ZAP Free Free and open source · add-ons available in the Marketplace zaproxy.org · 29 Sept 2026

Compared on penetration testing software

Free plan: Yes
Authenticated scanning: Yes
API testing: Yes
Browser-based scanning: Yes
CI/CD integration: Yes
Deployment model: self_hosted

Best OWASP ZAP alternatives

See all 20

Dradis 0 of 4 in the starter kit Lesson 18.0 Pentesterra 0 of 4 in the starter kit Lesson 27.5 RedAmon 0 of 4 in the starter kit Lesson 37.3 Caido 0 of 4 in the starter kit Lesson 47.2 Burp Suite DAST 0 of 4 in the starter kit Lesson 57.1 Faraday 0 of 4 in the starter kit Lesson 67.1

The record

Purpose: ZAP is a web application scanner and proxy for security testing.
Open source: ZAP describes itself as free and open source, and says anyone can contribute to the project.
Scanner: ZAP provides active scanning, passive scanning, a spider, alerts, and scan policies.
Add-ons: Add-ons can be installed dynamically from the online Marketplace, and are typically added or removed without restarting ZAP.
Automation: The Automation Framework controls ZAP with a YAML plan and supports jobs including active scanning, passive scanning, spidering, API imports, and report generation.
CI integration: ZAP provides GitHub Actions for baseline, full, and API scans through its Docker packaged scans.
API formats: The Automation Framework supports importing OpenAPI, GraphQL, SOAP, and Postman definitions through jobs or add-ons.
Deployment: ZAP publishes Docker images, including a bare image described as minimal and ideal for CI.
Audience: ZAP says it is designed for developers, testers new to security testing, and security testing specialists.
Runtime requirement: The Windows and Linux installers require Java 17 or higher, while the macOS installer includes Java 17.
Release support: The download page says the ZAP team can support only the latest full release.
Download security: The download page warns that current ZAP releases are unsigned and provides checksums for downloads.
Project status: ZAP says it has not been an OWASP project since August 2023 and identifies its current name as ZAP or ZAP by Checkmarx.
Third-party integrations: ZAP lists DefectDojo, Dradis, and Faraday among products and services that can import ZAP results.
Price from: Free

Where it ranks on The Geeks Club

Best Penetration Testing Software in 2026#11 of 35
Best Web Application Security Scanners in 2026#9 of 31
Best Dynamic Application Security Testing Software in 2026#6 of 28

Is OWASP ZAP yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote OWASP ZAP

Sources

zaproxy.org· checked 29 Sept 2026
zaproxy.org/docs/desktop/start/features/· checked 29 Sept 2026
zaproxy.org/docs/desktop/start/features/addons/· checked 29 Sept 2026
zaproxy.org/docs/automate/automation-framework/· checked 29 Sept 2026
zaproxy.org/docs/docker/about/· checked 29 Sept 2026
zaproxy.org/download/· checked 29 Sept 2026
zaproxy.org/getting-started/· checked 29 Sept 2026
zaproxy.org/docs/nowaspzap/· checked 29 Sept 2026
zaproxy.org/third-party-services/· checked 29 Sept 2026