# Discovering Vulnerabilities using OWASP ZAP

**Zed Attack Proxy (ZAP)** is a free, open-source penetration testing tool being maintained under the umbrella of the Open Web Application Security Project (OWASP). ZAP is designed specifically for testing web applications and is both flexible and extensible.

<figure><img src="https://1589701199-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fi9hCCmXtAKNvbIKRqULt%2Fuploads%2Fb1YINjRlktXxtPtGMQFY%2Fzap_conf.png?alt=media&#x26;token=cc06c765-fdd1-43e0-9542-b966171dd269" alt=""><figcaption></figcaption></figure>

* To run a vulnerability scan with click on the square in the left, and if you want to click on default policy and modify.

<figure><img src="https://1589701199-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fi9hCCmXtAKNvbIKRqULt%2Fuploads%2FupsOi2y0Bm2MDB3384yd%2Fzap_conf2.png?alt=media&#x26;token=50beca23-659c-49c0-bc8c-9e57469ac9b2" alt=""><figcaption></figcaption></figure>

* In this option you will be seeing all the vulnerability scans that you can run and their level of strength.

<figure><img src="https://1589701199-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fi9hCCmXtAKNvbIKRqULt%2Fuploads%2FkvYddkydDLkuIQIilH5u%2Fzap_scanning.png?alt=media&#x26;token=a0933bf4-92f8-4738-9202-61ea981ed9a2" alt=""><figcaption></figcaption></figure>

* Once you set your configurations, start the attack and see how it is going.

<figure><img src="https://1589701199-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fi9hCCmXtAKNvbIKRqULt%2Fuploads%2FV6w2H74LnIp8Vqi31HAj%2Fzap_scan_results.png?alt=media&#x26;token=e4e1a1a8-1a4a-4afb-a95b-8c9cec52e2e4" alt=""><figcaption></figcaption></figure>

* Here in the following image, you can see all the possible vulnerabilities to analyze them.
