OWASP Zap Reviews

We use OWASP Zap primarily for discovering vulnerabilities in our web application security testing. We use one standalone deployment of this solution.

OWASP Zap has been good for reducing security incidents in our organization, doing very well with that.

OWASP is only meant for two or three different types of scans. It is a tool which will scan the code for security for vulnerabilities.

We were able to convince the customers to really remove those rules when GitLab was able to show the results. Customers should be aware that GitLab is not just a source controller or version control tool; it is more than that.

I have been working with OWASP Zap for a few years now, and it is similar to Burp Suite, being open source, but it has limitations, especially with the minimal scan engines that it offers compared to Burp Suite.

The powerful side of OWASP Zap includes features such as fuzzing activities, which allow us to perform fuzzing with manual payloads where we can inject and observe the outputs.

I consider OWASP Zap to be the most effective solution overall; being open source allows integration with other systems via OWASP Zap APIs.

I primarily use OWASP Zap for DevSecOps within the pipeline. It's mainly integrated via a YAML file into GitHub actions. In addition to that, I use it for external tests like web crawling and web application penetration tests.

OWASP Zap's add-on feature to customize wordlists is very useful for tasks like brute forcing credentials and other test cases. Additionally, the reporting feature is effective as it provides remediation suggestions and allows for flagging false positives, which helps in reducing noise in the reports.

I use it for vulnerability scanning. It has automatic methods. It's great.

We integrate OWASP Zap into our other software development lifecycle processes for security.

I use OWASP Zap for vulnerability scanning. After that, I used OWASP Zap to try fuzzing. To fuzz some inputs that might have medium or high severity problems discovered during the vulnerability scanning.

OWASP Zap's spidering capabilities have improved our security testing. I would rate this capability an eight out of ten. The feature is very useful, but maybe the algorithm for discovery must be improved. It can generate many false positives. But the overall feature is good.

We use the solution for scanning pipelines.

It is a good solution. We get good feedback about the product from our clients. The product helps users to scan and fix vulnerabilities in the pipeline.

I use the solution to follow the framework and help my developers develop apps securely from the ground up with the right practices in mind. As part of the DevOps process, we use the tool to scan and see if the web apps are vulnerable. We integrated the tool into our development life cycle for security testing in our DevOps pipeline. We use the tool to spider and test the website.

The solution helped identify attacks like Cross-site Scripting and SQL Injection. We can perform general health checks to see if the site is secure. If there are problems, they get fixed by the developers before they get to production.

OWASP Zap is used for dynamic testing. So when any kind of application, like, a web application, needs to be tested for its security and vulnerabilities. It is also used to crawl the site and then to enumerate all the input or the possible exploitation points, and then we try to exploit any blockings within OWASP Zap.

It improved our company's functioning because it integrates and can automate most of our workflow, so it helps. Based on its automation abilities, I rate it a seven out of ten. But there are many things that I have to do manually for safety and better clarification.