Name: ZAP by Checkmarx
Rating: 7.1 (2 reviews)
Author: Checkmarx

Help Desk

Web and Video Conferencing

Customer Support

Batch Management Software

Product Lifecycle Management (PLM)

Development

Business Intelligence (BI)

Collaboration

Digital Rights Management (DRM)

Enhanced 911 (E911)

Facility Management

IP PBX

Operational Analytics

Policy Management

Enterprise

Accounting

Invoicing

Nonprofit Accounting

Subscription Management

Finance and Accounting

Applicant Tracking

Corporate Learning Management

Employee Recognition

Employee Scheduling

HR Management

Payroll

Stock Option Plan Administration

Talent Intelligence

Talent Management

Workforce Analytics

Workforce Management

Human Resources

Application Performance Management (APM)

Archiving

Build Automation

Cloud Cost Management

Cloud Storage

Code Review

Configuration Management Databases

Data Mapping

Density-Optimized Servers

Email Encryption

Firewall Security Management

Fraud Detection

IP Address Management (IPAM)

IT Service Providers

Integration Platform as a Service (iPaaS)

Log Management

Managed DNS

Network Performance Monitoring

Software-Defined WAN

System Monitoring

Web Scraping

WiFi Hotspot

Workload Automation

Information Technology

A/B Testing

Ad Serving & Retargeting

All-in-One Marketing

Audio Editing

Content Management

Email Deliverability

Email Marketing

Marketing Automation

Online Proofing

Search Engine Marketing (SEM)

Social Media Management

Social Media Marketing

Survey & Forms Building

Web Analytics

Marketing

Job Site Management

Project Management

Waste Management

Writing and Proofreading Tools

Professional Services

Customer Relationship Management (CRM)

Product Configuration

Social Commerce

Sales

Laboratory Information Management

Membership Management

Roofing

Vertical-Specific

Find top rated software and services based on in-depth reviews from verified users. 400+ software categories including PaaS, NoSQL, BI, HR, and more.

Checkmarx

SonarQube Server

SonarSource Sarl

Palo Alto Networks Prisma Cloud

Palo Alto Networks

Cybereason Defense Platform

Cybereason

Veracode

Acunetix by Invicti

Invicti Security

GitLab

S4 for Salesforce

DigitSec

Coverity Static Analysis (SAST)

Synopsys

Sentinel Source

Mend SAST

Mend.io

Reshift

Reshift Security

Semgrep

Beyond Security beSOURCE

Fortra

Brakeman Scanner

Open Source

OWASP ZAP (Zed Attack Proxy) is an open-source web application security scanner designed to assist developers and security professionals in identifying vulnerabilities and security issues in web applications. It is suitable for organizations of all sizes, from small startups to large enterprises. Web developers, security analysts, security testers, IT managers, and software engineers across various industries rely on OWASP ZAP to ensure the security of their web applications.

## Key Features

**ZAP in Ten**: A series of short videos (~10 mins each) about different ZAP features, produced in collaboration with All Day DevOps.

**ZAP Marketplace**: Contains ZAP add-ons contributed by the community, extending the functionalities of ZAP. Add-ons can be browsed and downloaded from within ZAP or imported manually.

**Automate with ZAP**: ZAP offers a range of options for security automation, with documentation available to help users get started with automating security testing.

**ZAP Desktop UI**: Features include Menu Bar, Toolbar, Tree Window, Workspace Window, Information Window, and Footer. Additional tabs are accessible via right-hand tabs with green '+' icons, and context-sensitive right-click options are available throughout the user interface.

**Manual Exploration**: Combines spiders and manual exploration for more effective vulnerability assessment. Users can explore all pages of a web application, including hidden pages, while ZAP passively scans requests and responses for vulnerabilities. Alerts are recorded for potential vulnerabilities found during exploration.

**ZAP Advanced Features**: The desktop version of ZAP offers a wide range of features that may not be immediately apparent. Additional tabs can be accessed by right-clicking and pinning them. The ZAP Marketplace provides various add-ons for additional functionality. Automation options include Docker Packaged Scans, GitHub Actions, and API and Daemon mode.

**ZAP User Guide**: Detailed instructions, references, instructional videos, and tips and tricks for using ZAP. Covers ZAP's capabilities, API, and command-line programming. Available online and accessible via the ZAP Desktop UI.

**WebSockets**: Allows inspection of WebSocket communication, enabling the analysis of WebSocket messages exchanged between the client and server. Provides visibility into the WebSocket protocol and helps identify potential security vulnerabilities. Useful for testing and securing applications that rely on WebSocket technology.

**Windows WebDrivers**: Includes Windows WebDrivers for Firefox and Chrome, enabling the automation of web browsers on the Windows operating system. Allows seamless integration with popular web browsers for efficient scanning and testing.

**Zest - Graphical Security Scripting Language**: A graphical security scripting language enhancing OWASP ZAP's macro language capabilities. Provides a user-friendly interface for creating security scripts, offering an intuitive and visual way to develop complex security testing scenarios.

Zed Attack Proxy, or ZAP, supported by Checkmarx, is an open source and free to use web app scanner.

SonarQube is a code quality and vulnerability solution for development teams that integrates with CI/CD pipelines to ensure the software you produce is secure, reliable, and maintainable.

Community

Developer EDITION

Enterprise EDITION

Data Center EDITION

Small Teams - 1-25 developers

Standard 26-100 developers

Standard - 26 to 100 developers

Enterprise - above 100 developers

GitGuardian

ZAP by Checkmarx

Application Security Testing is a key element of ensuring that web applications remain secure. Various tools and managed services exist to provide continuous testing, besides application security platforms that include app testing as part of their functionality. Static Application Security Tests (SAST) examine applications while they are not running, searching source code for errors and security vulnerabilities.

Static Application Security Testing (SAST)

TrustRadius is a technology and business research firm based in Austin, Texas. The company is known as a review platform for verified B2B technology and software reviews through a proprietary algorithm and human verification.

TrustRadius

Home

Static Application Security Testing (SAST) Tools

ZAP by Checkmarx

Overview

What is ZAP by Checkmarx?