At IT Sonix, we regularly explore new testing methods to meet our high standards for software quality. Recently, our experts took a closer look at the ZAP by Checkmarx (Zed Attack Proxy) tool and evaluated it for use in our projects. Software development using AI has now taken hold in German companies, and with it, the number of software products on the market is also increasing. Fast development cycles and increased output can heighten the risk of errors. This makes review processes even more important than they have been in the past.
Here at IT Sonix, we also work with AI and develop our own AI solutions to provide our customers with the best possible software. Our quality assurance team ensures that our applications are secure and that our customers can make them available to the general public with confidence.
Security issues usually end up costing a lot of money, and the best way to deal with them is to prevent them from happening in the first place.
What is ZAP?
ZAP is an open-source project that originated within the OWASP (Open Worldwide Application Security Project) community and has been further developed by Checkmarx since 2024. The application is free of charge and is particularly well-suited for web and API security testing.
Thanks to its platform independence, ZAP can be used on Windows, macOS, and Linux. Its feature set and ease of use make it appealing to beginners, professional penetration testers, and developers alike. ZAP is a valuable tool for identifying common web vulnerabilities such as:
- XSS
- SQL Injection
- Authentication and Authorization Errors
The application is one of the so-called DAST (Dynamic Application Security Testing) tools. These security solutions scan web applications and APIs from the outside for vulnerabilities without needing to know the source code. They simulate hacker attacks (e.g., SQL injection, XSS) to identify runtime issues.
Use Cases
In our tests, ZAP proved to be a reliable partner, particularly for security testing of traditional web applications such as single-page applications (SPA) and for conducting API tests (REST, SOAP interfaces). The tool also excels at supporting bug bounty programs. Furthermore, ZAP is ideal for training and education in the field of web security.
How does ZAP work?
The tool acts as a man-in-the-middle between the browser and the target application (web application). It records and analyzes HTTP(S) requests and responses. ZAP enables manual or automated analysis as well as the replay of requests. ZAP also supports “fuzzing,” which is the automated modification of variables in requests.
Operation and Features
The system is operated via three interfaces:
- Desktop
- HUD (Head-Up Display)
- API (Can be integrated into other applications)
The main feature is the intercepting proxy with a history view. Here, users can view all requests and modify, inspect, and execute them. In addition, there are spiders and AJAX crawlers for automated path detection in black-box testing.
The AJAX crawler in ZAP was specifically designed to crawl SPAs and other dynamically reloading pages. A standard crawler (a program that automatically follows links on a website) would not find all the content on an SPA because much of it only becomes visible through clicks and interactions. The AJAX crawler simulates these interactions.
Another helpful feature is the ability to run scans. ZAP distinguishes between passive and active scanners.
Passive Scan:
- The tested application receives regular traffic and cannot detect the scan
- No additional attacks are attempted
- Identifying header issues, HTTP configuration, information leaks
Active Scan:
- Targeted attacks on parameters, forms, and endpoints
- focuses on vulnerabilities such as XSS, SQL injection, RFI, etc.
- Only with permission and in test environments
- behaves more aggressively to provoke vulnerabilities; never in production environments
In addition, there are different types of scans:
- automated
- manual exploration
While automated scans are performed regularly and cover a broad scope, manual scans are more in-depth. Both methods provide a comprehensive security assessment.
Automated Scan
- uses predefined rules and test policies without manual intervention
- Efficient for broad coverage and regular iterations (e.g., in CI/CD)
- reliably and quickly detects known vulnerability patterns
Manual Exploration
- Manual, context-based testing with custom payloads
- allows for adaptation to specific application logic and unusual structures
- detects complex or unusual vulnerabilities that automated scans miss
In addition, ZAP can be expanded using Marketplace add-ons. Our experts recommend:
- Active Scanner Rules (Alpha / Beta): These add-ons expand the scan rules to include new, specialized attack patterns
- Community Scripts: These are a collection of scripts created by the OWASP ZAP community to extend ZAP's functionality beyond the standard add-ons. Examples include filling in OTPs for MFA authentication, RSA signing, and much more.
Integration with CI/CD and DevSecOps
Ever-faster development cycles, frequent releases, and automated deployments have permanently transformed the modern software landscape. This also increases the risk of overlooking security vulnerabilities during the review process. DevSecOps ensures that security considerations are not checked at the end, but are integrated early and automatically into the development process.
The ZAP REST API enables extensive automation of scans and integrates critical security scans into the DevOps development process. This is an important step toward DevSecOps. ZAP offers a headless mode for non-interactive build pipelines. The option to export reports (HTML, XML, JSON) supports documentation and tracking. ZAP can be used for scans in test environments, but can also be integrated as a quality gate in the development process. This allows the tool to provide information about the security of the implementation as early as the pull request stage. This brings problem detection closer to the development process and speeds up bug fixes.
Conclusion
ZAP stands out above all for its free, open-source model. It is also highly versatile and has a large community. As a result, it is extremely powerful and always stays up to date.
The tool provides solid support for identifying classic web vulnerabilities and is well-suited for training and initial penetration tests. Its limitations become apparent when it comes to logical vulnerabilities (e.g., complex business logic), as well as with mobile apps. It is important not to view the results as a fully automated guarantee of security, as they are merely indications.
Our experts recommend running the tests only on systems with explicit authorization and deliberately limiting the scope and scan policies. Active scans should preferably be performed in test or staging environments. For production use, it is important to prioritize results and address them systematically in subsequent sprints.
In addition, regular updates for ZAP and add-ons are essential. By keeping these points in mind, you’ll have a powerful tool for assessing security risks in web applications.
Quality assurance isn’t just a nice-to-have. It plays a crucial role in the development of excellent software. For over 20 years, we at IT Sonix have been building high-quality software solutions, placing great emphasis on a holistic development process. The result satisfies our customers and gives them the technological edge they need to succeed in today’s fast-paced market.
