Zed Attack Proxy (@zaproxy) header
Zed Attack Proxy (@zaproxy) profile picture

Zed Attack Proxy

@zaproxy

Official announcements (low vol) for ZAP by @Checkmarx - the worlds most popular web app scanner. Free and open source. https://xitter.twitterapi.xyz/t.co/pxO8zZ6usH

zaproxy.org
Joined June 2011
  • Tweets990
  • Following5
  • Followers15.4K
Want to learn more about ZAP? The latest tutorial videos are all linked off zaproxy.org/videos/ - we're adding to them all of the time.
6
46
1
99
Blog: Intercepting all Android traffic with ZAP zaproxy.org/blog/2026-11-10-… c/o zaptun - a community add-on by David Araújo #zaproxy #appsec #android
Intercepting all Android traffic with ZAP

Intercepting all Android traffic with ZAP

zaptun is a community add-on by David Araújo that captures all of the traffic from an Android emulator or rooted device in ZAP with one click. It uses a VPN rather than a proxy, so apps that ignore...

zaproxy.org
18
1
33
1,455
Authenticating to modern web apps is hard. The Authentication Helper add-on now has an AI Assisted Authentication method which uses an LLM to work out how to log in, then turns that into a fast, repeatable Client Script. zaproxy.org/blog/2026-11-03-…
AI Assisted Authentication

AI Assisted Authentication

Authenticating to modern web apps is hard. The Authentication Helper add-on now has an AI Assisted Authentication method which uses an LLM to work out how to log in, then turns that into a fast,...

zaproxy.org
1
10
27
1,135
Blog post: zaproxy.org/blog/2026-11-02-… OAuth2 support has landed in the Authentication Helper, the Browser Extension has a new Script Viewer, ZAP can detect PHP2Shell, and we explain how we’re developing ZAP in the LLM age. #zaproxy #appsec
ZAP Updates - October 2026

ZAP Updates - October 2026

OAuth2 support has landed in the Authentication Helper, the Browser Extension has a new Script Viewer, ZAP can detect PHP2Shell, and we explain how we’re developing ZAP in the LLM age.

zaproxy.org
2
5
16
842
The ZAP Network add-on has been updated to use the latest Brotli library. We do not believe that Java is affected by CVE-2026-111497 but we still recommend that you update this add-on from the ZAP Marketplace ASAP. We have also regenerated the stable Docker image. #zaproxy
2
6
1
15
1,350
All ZAP versions from 2.14 use the old Brotli library, but as usual only the latest version of ZAP will receive the patch. We strongly advise those of you running old versions of ZAP to update to 2.17.0
2
3
236
Blog: Detecting PHP2Shell and Other PHP Vulnerabilities with ZAP PHP2Shell is the latest big “named” vulnerability. ZAP can now tell you if a site is running a vulnerable version of PHP, and it does so without sending a single extra request. zaproxy.org/blog/2026-10-22-… #php2shell
Detecting PHP2Shell and Other PHP Vulnerabilities with ZAP

Detecting PHP2Shell and Other PHP Vulnerabilities with ZAP

PHP2Shell is the latest big “named” vulnerability. ZAP can now tell you if a site is running a vulnerable version of PHP, and it does so without sending a single extra request.

zaproxy.org
2
10
1
19
1,033
The ZAP Browser Extension (version 0.3.0) has a new Script Viewer. You can now see the Zest script you are recording as you record it, then edit it, replay it step by step, and load and save it, all without leaving the browser. zaproxy.org/blog/2026-10-21-… #zaproxy #appsec
View, edit, and replay your recorded Zest scripts

View, edit, and replay your recorded Zest scripts

The ZAP Browser Extension (version 0.3.0) has a new Script Viewer. You can now see the Zest script you are recording as you record it, then edit it, replay it step by step, and load and save it, all...

zaproxy.org
1
7
8
724
LLMs have changed how software is developed - read about how we’re handling that change in the ZAP project: zaproxy.org/blog/2026-10-13-… #zaproxy #oss #llm
Developing ZAP in the LLM Age

Developing ZAP in the LLM Age

LLMs have made it much easier to generate code, which changes the balance of how open source projects like ZAP are developed. We are not closing the door on new contributors - ZAP has always been a...

zaproxy.org
5
11
735
Initial support for handling OAuth2.0 is now available. Details on the ZAP Blog: zaproxy.org/blog/2026-10-08-… Lots of other add-ons have also been updated, so update ZAP now! #appsec #zaproxy
Initial OAuth2.0 support

Initial OAuth2.0 support

The Authentication Helper add-on now ships with an OAuth2 authentication method for the non-interactive grant types: client_credentials and password. This is an early release and we want your...

zaproxy.org
7
10
607
Big set of add-on releases this morning #zaproxy #dast #AppSec #WebAppSec
Image from Zed Attack Proxy (@zaproxy)
8
11
695
ZAP Updates for September: The AJAX Spider and DOM XSS add-ons have now been fully retired from ZAP's nightly and weekly releases, and Phase 1 of the new Global Scan Policy Manager has landed behind a dev-mode flag. zaproxy.org/blog/2026-10-01-… #zaproxy #appsec
ZAP Updates - September 2026

ZAP Updates - September 2026

The AJAX Spider and DOM XSS add-ons have now been fully retired from ZAP’s nightly and weekly releases, and Phase 1 of the new Global Scan Policy Manager has landed behind a dev-mode flag.

zaproxy.org
1
5
10
753
The latest weekly release does not include the AJAX Spider and DOM XSS add-ons. You can install them via the Marketplace as usual, but we recommend you using the Client Spider and OWASP PTK add-ons instead. For more details see zaproxy.org/blog/2026-09-08-… #zaproxy #appsec
ZAP Updates - August 2026

ZAP Updates - August 2026

We’re retiring the AJAX Spider and DOM XSS add-ons from the nightly and weekly releases, and the new LLM Support add-on officially launched in August.

zaproxy.org
7
10
609
ZAP updates for August. We’re removing 2 add-ons from the nightly and weekly releases, so if you use those then make sure you read it to understand the implications. zaproxy.org/blog/2026-09-08-… #zaproxy #appsec
ZAP Updates - August 2026

ZAP Updates - August 2026

We’re retiring the AJAX Spider and DOM XSS add-ons from the nightly and weekly releases, and the new LLM Support add-on officially launched in August.

zaproxy.org
1
6
8
522
ZAP's Technology Detection add-on got a new icon in today's release.
1
1
5
1,057
Introducing ZAP LLM Support: zaproxy.org/blog/2026-08-07-… A new optional, opt-in add-on that lets you connect ZAP to an LLM of your choice. #zaproxy #appsec
The ZAP LLM Support Add-on

The ZAP LLM Support Add-on

A new optional, opt-in add-on that lets you connect ZAP to an LLM of your choice, powering an interactive chat panel and AI-assisted features in the OpenAPI and Alert Filters add-ons.

zaproxy.org
8
17
1,304
zaproxy.org/blog/2026-08-06-… - a huge increase in the number of times ZAP was started, and we now recommend using the Client Spider instead of the AJAX Spider #zaproxy #appsec

ZAP Updates - July 2026

ZAP was started more than 13 million times in July, another big jump, and the Client Spider officially became our recommended option for crawling modern web apps.

zaproxy.org
4
1
13
1,380
It has been 3 years since ZAP left @owasp Update your docs! zaproxy.org/docs/nowaspzap/
N⛔WASP ZAP

N⛔WASP ZAP

ZAP is no longer an OWASP project, and has not been one since August 2023. So if you see ZAP referred to as “OWASP ZAP” anywhere, that reference is out of date - the correct name is just ZAP, or ZAP...

zaproxy.org
4
16
1,274
Big announcement! We now recommend that you use the Client Spider for crawling modern web apps, instead of the AJAX Spider. More details in the blog post: zaproxy.org/blog/2026-07-06-… #zaproxy #appsec
Use the Client Spider for Modern Web Apps

Use the Client Spider for Modern Web Apps

We now recommend the Client Spider over the AJAX Spider for crawling modern web applications. It finds more endpoints, scales much better vs large apps, and unlocks PTK’s passive coverage for free.

zaproxy.org
4
10
854
ZAP Blog: June Updates zaproxy.org/blog/2026-07-01-… More PTK integration, lots of Client Spider improvements, and much more.. #zaproxy #appsec
ZAP Updates - June 2026

ZAP Updates - June 2026

In June the OWASP PTK add-on graduated to beta with its integration now properly matching ZAP’s architecture, a security advisory was issued and patched for the Viewstate add-on, and the Client...

zaproxy.org
4
6
1,015
Blog Post: Even More OWASP PTK Integration with ZAP. SAST and IAST passive scanning out of the box with the Client Spider, and the active rule is now enabled by default. zaproxy.org/blog/2026-06-29-… @pentestkit #zaproxy #owaspptk #appsec
Even More OWASP PTK Integration with ZAP

Even More OWASP PTK Integration with ZAP

The PTK add-on graduates to beta, the active scan rule is on by default, recommended rule defaults reduce noise by avoiding duplicate findings, and a new Engines tab gives you fine-grained control...

zaproxy.org
4
5
672
Load more