Install OWASP ZAP on Kali Linux

What ZAP is

OWASP ZAP (Zed Attack Proxy) is a free security testing tool for web apps. Its main parts:

1. Proxy. Intercepts web traffic so you can read and change requests.
2. Scanner. Looks for vulnerabilities automatically.
3. Spider. Finds new URLs in a web app by following links.
4. Fuzzer / Intruder. Sends many variations of a request.
5. Repeater. Sends a captured request again with changes.

Before you start

ZAP needs Java. Check it:

java -version

If Java is missing:

sudo apt install default-jre

Method 1: The package manager

sudo apt install zaproxy

This is the simplest way and gives you updates with the rest of your system.

Method 2: The ZAP installer

1. Open the ZAP download page on the OWASP/ZAP website and choose the Linux Installer.

   

2. Download the file. It is a shell script.

   

3. Open a terminal and go to the folder with the file. Make the script executable (the +x option is enough; avoid 777):

chmod +x ZAP_2_14_0_unix.sh

1. Run it:

./ZAP_2_14_0_unix.sh

1. Follow the installation wizard. Choose the install folder and finish.

   

Start ZAP

From the menu: Applications, Web Application Analysis, ZAP. Or from a terminal:

zaproxy

On the first start, choose whether to keep the session. The main window opens.

First scan

In the Quick Start tab, click Automated Scan, enter the URL of your own app and click Attack. ZAP spiders the site and runs the active scan. Read the results under the Alerts tab.

Quick recap

• Install Java, then sudo apt install zaproxy.
• Or run the Linux installer script.
• Scan only your own apps.