{"id":53847,"date":"2025-10-11T03:00:27","date_gmt":"2025-10-11T03:00:27","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=53847"},"modified":"2025-10-11T03:00:27","modified_gmt":"2025-10-11T03:00:27","slug":"owasp-zap-step-by-step-guide-to-install-latest-version-of-owasp-zap","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/owasp-zap-step-by-step-guide-to-install-latest-version-of-owasp-zap\/","title":{"rendered":"OWASP ZAP: Step by Step Guide to install Latest version of owasp zap"},"content":{"rendered":"\n<p>Here\u2019s a clean, step-by-step guide to install the <strong>latest OWASP ZAP<\/strong> on any OS, plus quick checks and headless\/CI tips.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><strong>Latest version right now:<\/strong> ZAP <strong>2.16.1<\/strong> (stable). (<a href=\"https:\/\/www.zaproxy.org\/download\/\" target=\"_blank\" rel=\"noopener\">ZAP<\/a>)<\/p>\n<\/blockquote>\n\n\n\n<h1 class=\"wp-block-heading\">1) Pick your install method (per OS)<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">Windows<\/h2>\n\n\n\n<p><strong>Easiest (Winget)<\/strong><\/p>\n\n\n<pre class=\"wp-block-code\"><span><code class=\"hljs\">winget install --id=ZAP.ZAP -e\n<\/code><\/span><\/pre>\n\n\n<p>To update later:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-1\" data-shcb-language-name=\"CSS\" data-shcb-language-slug=\"css\"><span><code class=\"hljs language-css\"><span class=\"hljs-selector-tag\">winget<\/span> <span class=\"hljs-selector-tag\">upgrade<\/span> <span class=\"hljs-selector-tag\">ZAP<\/span><span class=\"hljs-selector-class\">.ZAP<\/span>\n<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-1\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">CSS<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">css<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p>(<a href=\"https:\/\/www.zaproxy.org\/download\/\" target=\"_blank\" rel=\"noopener\">ZAP<\/a>)<\/p>\n\n\n\n<p><strong>Alternative (Scoop)<\/strong><\/p>\n\n\n<pre class=\"wp-block-code\"><span><code class=\"hljs\">scoop install zaproxy\n<\/code><\/span><\/pre>\n\n\n<p>(<a href=\"https:\/\/www.zaproxy.org\/download\/\" target=\"_blank\" rel=\"noopener\">ZAP<\/a>)<\/p>\n\n\n\n<p><strong>Traditional installer<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Download the <strong>Windows Installer<\/strong> for 2.16.1.<\/li>\n\n\n\n<li>Double-click, accept license, finish.<br>(Windows builds <strong>require Java 17+<\/strong>; see step 2.) (<a href=\"https:\/\/www.zaproxy.org\/download\/\" target=\"_blank\" rel=\"noopener\">ZAP<\/a>)<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">macOS<\/h2>\n\n\n\n<p><strong>Homebrew (recommended)<\/strong><\/p>\n\n\n<pre class=\"wp-block-code\"><span><code class=\"hljs\">brew install --cask zap\n<\/code><\/span><\/pre>\n\n\n<p>(2.16.1 as of today.) (<a href=\"https:\/\/formulae.brew.sh\/cask\/zap?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">Homebrew Formulae<\/a>)<\/p>\n\n\n\n<p><strong>Direct installer<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Download the <strong>macOS (Intel\/Apple Silicon) installer<\/strong> and run it.<br>(Mac installers <strong>include Java 17<\/strong>.) (<a href=\"https:\/\/www.zaproxy.org\/download\/\" target=\"_blank\" rel=\"noopener\">ZAP<\/a>)<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Linux (Ubuntu\/Debian\/Fedora\/\u2026)<\/h2>\n\n\n\n<p><strong>Snap (simple &amp; maintained by ZAP team)<\/strong><\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-2\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code class=\"hljs language-php\">sudo snap install zaproxy --classic\n<span class=\"hljs-comment\"># later:<\/span>\nsudo snap refresh zaproxy\n<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-2\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p>Then run:<\/p>\n\n\n<pre class=\"wp-block-code\"><span><code class=\"hljs\">zaproxy\n<\/code><\/span><\/pre>\n\n\n<p>(<a href=\"https:\/\/www.zaproxy.org\/download\/\" target=\"_blank\" rel=\"noopener\">ZAP<\/a>)<\/p>\n\n\n\n<p><strong>Flatpak<\/strong><\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-3\" data-shcb-language-name=\"CSS\" data-shcb-language-slug=\"css\"><span><code class=\"hljs language-css\"><span class=\"hljs-selector-tag\">flatpak<\/span> <span class=\"hljs-selector-tag\">install<\/span> <span class=\"hljs-selector-tag\">flathub<\/span> <span class=\"hljs-selector-tag\">org<\/span><span class=\"hljs-selector-class\">.zaproxy<\/span><span class=\"hljs-selector-class\">.ZAP<\/span>\n<span class=\"hljs-selector-tag\">flatpak<\/span> <span class=\"hljs-selector-tag\">run<\/span> <span class=\"hljs-selector-tag\">org<\/span><span class=\"hljs-selector-class\">.zaproxy<\/span><span class=\"hljs-selector-class\">.ZAP<\/span>\n<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-3\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">CSS<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">css<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p>(<a href=\"https:\/\/www.zaproxy.org\/download\/\" target=\"_blank\" rel=\"noopener\">ZAP<\/a>)<\/p>\n\n\n\n<p><strong>Official Linux repos (RPM\/DEB via openSUSE Build Service)<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Follow the repo instructions for your distro on the \u201cLinux Repos\u201d link, then install the <code>zap<\/code>\/<code>zaproxy<\/code> package. (<a href=\"https:\/\/www.zaproxy.org\/download\/\" target=\"_blank\" rel=\"noopener\">ZAP<\/a>)<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Docker (great for CI\/CD or zero-Java setup)<\/h2>\n\n\n\n<p>Pull a prebuilt image:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-4\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code class=\"hljs language-php\">docker pull ghcr.io\/zaproxy\/zaproxy:stable\n<span class=\"hljs-comment\"># or docker pull zaproxy\/zap-stable<\/span>\n<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-4\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p>(<a href=\"https:\/\/www.zaproxy.org\/download\/\" target=\"_blank\" rel=\"noopener\">ZAP<\/a>)<\/p>\n\n\n\n<h1 class=\"wp-block-heading\">2) Pre-req: Java (when needed)<\/h1>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Required for Windows\/Linux installers and cross-platform zip<\/strong>: <strong>Java 17+<\/strong>.<\/li>\n\n\n\n<li><strong>Not needed<\/strong> for Docker; <strong>bundled on macOS installer<\/strong>.<br>Get Java 17 (Temurin) if you don\u2019t have it. (<a href=\"https:\/\/www.zaproxy.org\/download\/\" target=\"_blank\" rel=\"noopener\">ZAP<\/a>)<\/li>\n<\/ul>\n\n\n\n<h1 class=\"wp-block-heading\">3) Verify the install &amp; version<\/h1>\n\n\n\n<p><strong>Desktop \/ CLI<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Start ZAP from Start Menu (Win), Applications (macOS), or <code>zaproxy<\/code> (Linux).<\/li>\n\n\n\n<li>Or print version via script: <code># macOS \/Applications\/ZAP.app\/Contents\/Java\/zap.sh -version # Linux zap.sh -version # Windows \"C:\\Program Files\\ZAP\\Zed Attack Proxy\\zap.bat\" -version<\/code> (<a href=\"https:\/\/www.zaproxy.org\/docs\/desktop\/cmdline\/?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">ZAP<\/a>)<\/li>\n<\/ul>\n\n\n\n<p><strong>(Optional) Verify checksums<\/strong><br>Checksums are listed on the 2.16.1 release\u2014compare after download. (<a href=\"https:\/\/www.zaproxy.org\/download\/\" target=\"_blank\" rel=\"noopener\">ZAP<\/a>)<\/p>\n\n\n\n<h1 class=\"wp-block-heading\">4) First run tips (TLS &amp; Add-ons)<\/h1>\n\n\n\n<ul class=\"wp-block-list\">\n<li>If you\u2019ll proxy HTTPS traffic through ZAP, install the <strong>ZAP Root CA<\/strong> in your browser (<strong>Options \u2192 Network \u2192 Server Certificates<\/strong>; generate\/save, then import to your browser\u2019s trusted roots). (<a href=\"https:\/\/www.zaproxy.org\/docs\/desktop\/addons\/network\/options\/servercertificates\/?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">ZAP<\/a>)<\/li>\n\n\n\n<li>Extend ZAP via <strong>Marketplace<\/strong> (Manage Add-ons). (<a href=\"https:\/\/www.zaproxy.org\/addons\/?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">ZAP<\/a>)<\/li>\n<\/ul>\n\n\n\n<h1 class=\"wp-block-heading\">5) Headless \/ automation (CI quick wins)<\/h1>\n\n\n\n<p><strong>Start ZAP headlessly with API key<\/strong><\/p>\n\n\n<pre class=\"wp-block-code\"><span><code class=\"hljs\">zap.sh -daemon -host 127.0.0.1 -port 8090 -config api.key=YOUR_SECRET_KEY\n<\/code><\/span><\/pre>\n\n\n<p>(Use <code>zap.bat<\/code> on Windows.) API key is <strong>required by default<\/strong> for security. (<a href=\"https:\/\/www.zaproxy.org\/docs\/desktop\/cmdline\/?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">ZAP<\/a>)<\/p>\n\n\n\n<p><strong>Packaged Docker scans<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Baseline (passive, prod-safe)<\/strong> <code>docker run -t ghcr.io\/zaproxy\/zaproxy:stable \\ zap-baseline.py -t https:\/\/example.com -r report.html<\/code> (Mount <code>-v $(pwd):\/zap\/wrk<\/code> to save reports.) (<a href=\"https:\/\/www.zaproxy.org\/docs\/docker\/baseline-scan\/\" target=\"_blank\" rel=\"noopener\">ZAP<\/a>)<\/li>\n\n\n\n<li><strong>Full scan (includes active attacks)<\/strong> <code>docker run -t ghcr.io\/zaproxy\/zaproxy:stable \\ zap-full-scan.py -t https:\/\/example.com -r full.html<\/code> (<a href=\"https:\/\/www.zaproxy.org\/docs\/docker\/full-scan\/\" target=\"_blank\" rel=\"noopener\">ZAP<\/a>)<\/li>\n<\/ul>\n\n\n\n<p><strong>Automation Framework (YAML plans)<\/strong><\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-5\" data-shcb-language-name=\"CSS\" data-shcb-language-slug=\"css\"><span><code class=\"hljs language-css\"><span class=\"hljs-selector-tag\">zap<\/span><span class=\"hljs-selector-class\">.sh<\/span> <span class=\"hljs-selector-tag\">-cmd<\/span> <span class=\"hljs-selector-tag\">-autogenmin<\/span> <span class=\"hljs-selector-tag\">zap-plan<\/span><span class=\"hljs-selector-class\">.yaml<\/span>\n<span class=\"hljs-selector-tag\">zap<\/span><span class=\"hljs-selector-class\">.sh<\/span> <span class=\"hljs-selector-tag\">-cmd<\/span> <span class=\"hljs-selector-tag\">-autorun<\/span> <span class=\"hljs-selector-tag\">zap-plan<\/span><span class=\"hljs-selector-class\">.yaml<\/span>\n<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-5\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">CSS<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">css<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p>(<a href=\"https:\/\/www.zaproxy.org\/docs\/desktop\/addons\/automation-framework\/?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">ZAP<\/a>)<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Quick \u201chappy path\u201d per OS (copy\/paste)<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Windows (winget)<\/strong> <code>winget install --id=ZAP.ZAP -e<\/code> Launch \u201cZAP\u201d from Start Menu. (<a href=\"https:\/\/www.zaproxy.org\/download\/\" target=\"_blank\" rel=\"noopener\">ZAP<\/a>)<\/li>\n\n\n\n<li><strong>macOS (brew)<\/strong> <code>brew install --cask zap open -a ZAP<\/code> (<a href=\"https:\/\/formulae.brew.sh\/cask\/zap?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">Homebrew Formulae<\/a>)<\/li>\n\n\n\n<li><strong>Linux (snap)<\/strong> <code>sudo snap install zaproxy --classic zaproxy<\/code> (<a href=\"https:\/\/snapcraft.io\/zaproxy?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">Snapcraft<\/a>)<\/li>\n\n\n\n<li><strong>Docker (baseline scan)<\/strong> <code>docker run -t ghcr.io\/zaproxy\/zaproxy:stable \\ zap-baseline.py -t https:\/\/example.com -r report.html<\/code> (<a href=\"https:\/\/www.zaproxy.org\/docs\/docker\/baseline-scan\/\" target=\"_blank\" rel=\"noopener\">ZAP<\/a>)<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Here\u2019s a clean, step-by-step guide to install the latest OWASP ZAP on any OS, plus quick checks and headless\/CI tips. Latest version right now: ZAP 2.16.1 (stable). (ZAP) 1) Pick&#8230; <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[11138],"tags":[],"class_list":["post-53847","post","type-post","status-publish","format-standard","hentry","category-best-tools"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/53847","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=53847"}],"version-history":[{"count":1,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/53847\/revisions"}],"predecessor-version":[{"id":53848,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/53847\/revisions\/53848"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=53847"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=53847"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=53847"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}