// what it is
Description
Originally 'Zed Attack Proxy', now under the Software Security Project. Java-based intercepting proxy + scanner + fuzzer with a strong CI integration story (zap-baseline.py, zap-full-scan.py) and an excellent automation API.
// use cases
What people use it for
- Automated baseline scans in CI/CD
- Free intercepting proxy for learning
- OWASP CRS pre-flight checks against staging
// commands
The commands you'll type
Baseline scan in CI
$ docker run -t owasp/zap2docker-stable zap-baseline.py -t https://target.tld