ZAP: the free security scanner and 10 typical checks

ZAP (Zed Attack Proxy, often called OWASP ZAP) is a free, open-source program that checks websites for common security mistakes. The project's site calls it the world's most widely used web app scanner. This text explains what ZAP is and what it checks. CzynszOK runs a ZAP baseline scan on every code change, on its public pages; what else we run on every change is in our checks post.

What ZAP is

ZAP sits between a browser and a site: it sees every request and response, so it can read them (passive mode) or change them and send them as a test (active mode). It is free software, and the project describes itself as an independent open-source project with its own team. Developers and security teams use it, including in automated pipelines that run on every code change.

Baseline scan and active scan

The baseline scan is short and passive. By default it crawls the site for one minute, waits for the analysis of the responses to finish and reports. According to the documentation ZAP performs no real attacks in that mode, so it suits automated pipelines, including production sites. It only sees what the server's responses show: missing headers, cookie flags, error messages.

An active scan does something different: it sends crafted requests to see whether the site can be fooled. That is why it is run against your own test environment, never against someone else's site and never without the owner's permission.

10 typical checks

Below are ten checks from ZAP's alert list, with the numbers from that list. All of them are passive, meaning they come from the server's responses alone.

1. Content-Security-Policy header not set (10038). This header tells the browser where a page may load scripts from, which makes injecting someone else's code harder.
2. No protection against framing (10020). Without it someone can put your page in an invisible frame and trick people into clicking (clickjacking).
3. X-Content-Type-Options missing (10021). The browser may then guess a file's type and treat data as a script.
4. Strict-Transport-Security not set (10035). This header forces an encrypted connection, even when someone types the address without https.
5. Cookie without the HttpOnly flag (10010). A script on the page can read such a cookie, so stealing a session is easier.
6. Cookie without the Secure flag (10011). It can then travel over an unencrypted connection.
7. Cookie without the SameSite attribute (10054). The browser attaches it to requests from other sites, which helps CSRF attacks.
8. No anti-CSRF tokens in forms (10202). A form without them can be forged from another site.
9. The server reveals its software version in the Server header (10036). A hint for someone searching for known holes in a specific version.
10. Vulnerable JavaScript library (10003). The page loads an old version of a library with a known hole.

A ZAP report can be long, but read it with a cool head: an alert is a hint, not a verdict. Some alerts do not apply to a given site and some are a conscious decision. A person judges that.

What this means for you

If you connect your bank through an app, ZAP is one of the tools that can check whether its site has basic mistakes. It does not replace a code review or a penetration test. On the Security page we describe only what we can prove today, and CzynszOK runs a ZAP baseline scan on its public pages, not on the screens behind login. What happens with your bank data is in the Privacy policy.

Frequently asked questions

Is ZAP free?

Yes. The project's site describes it as free, open-source software.

Can a ZAP scan harm a site?

The baseline scan is passive and, according to the documentation, performs no attacks. An active scan sends requests that are harmful by design, so it is run only on an environment you have the right to test and where a crash does not hurt.

Does a clean ZAP report mean a site is secure?

No. A clean report only means ZAP found nothing in what it checks. Flaws in an app's logic, for example one user being able to see another's data, need a code review and tests that a baseline scanner does not perform.

Can I scan someone else's site?

Not without the owner's permission. Scanning a site without consent is the quickest way into trouble. If you find a hole by accident, report it to the owner.