Web & API
OWASP ZAP
Open-source intercepting proxy and scanner for web and API assessments.
What it is
ZAP covers the same job as a commercial proxy when the kit must stay open-source: intercept, spider, active/passive scan, and OpenAPI import. Tune scan policies down on production. Automation framework fits CI-style retests the client may want to keep after you leave.
Reach for it when
Web or API work on a desk that prefers open tooling, or when the client asks for a scanner they can rerun.
Watch-outs
Default active scan is noisy and includes rules that can submit forms. Use a dedicated scan user, exclude logout and destructive routes, and never point the spider at an SSO IdP you do not own.
Typical invocation
zap.sh -cmd -quickurl https://portal.example -quickout zap-report.html
Authorized assessments only. Stay inside the rules of engagement.
Pin to a kit
Open an engagement first.
Related
- Burp Suite
Intercepting proxy and scanner for authorized web and API testing, mapping, and manual review.
- Caido
Modern intercepting proxy for manual web and API testing with a workflow-oriented UI.
- nuclei
Template-based vulnerability scanner for known issues on in-scope web, API, and network services.
- ffuf
Fast web fuzzer for content discovery and parameter enumeration on in-scope applications.