{"id":1039,"date":"2026-07-26T06:39:08","date_gmt":"2026-07-26T06:39:08","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/?p=1039"},"modified":"2026-07-26T06:39:09","modified_gmt":"2026-07-26T06:39:09","slug":"how-to-install-and-configure-zap-proxy-on-macos-a-complete-step-by-step-guide-for-beginners","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/how-to-install-and-configure-zap-proxy-on-macos-a-complete-step-by-step-guide-for-beginners\/","title":{"rendered":"How to Install and Configure ZAP Proxy on macOS: A Complete Step-by-Step Guide for Beginners"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>Last updated: 26 July 2026<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP, formerly known as OWASP ZAP, is a free and open-source web application security testing tool. It can act as a proxy between your browser and a web application, allowing you to inspect requests, analyse responses, discover application endpoints, and identify potential security vulnerabilities.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This guide explains how to install and configure <strong>ZAP Proxy on macOS<\/strong> from the beginning. Every step is written for new users, so you do not need previous penetration-testing or proxy-configuration experience.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As of July 2026, <strong>ZAP 2.17.0<\/strong> is the latest stable core release. Separate installers are available for Intel-based Macs and Apple Silicon Macs. The official macOS installer includes the required Java runtime, so users installing through the standard macOS package do not normally need to install Java separately.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Important security and legal warning<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP can send attack-style requests designed to identify vulnerabilities. These requests may change data, create records, trigger application functions, increase server load, or affect the availability of the target system.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Only perform active scanning against:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Applications you own<\/li>\n\n\n\n<li>Local applications running on your computer<\/li>\n\n\n\n<li>Dedicated security-testing environments<\/li>\n\n\n\n<li>Systems for which you have explicit written permission<\/li>\n\n\n\n<li>Intentionally vulnerable training applications<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Do not actively scan public websites merely because they are accessible through a browser. The ZAP project explicitly warns that active scanning is an attack and should not be performed against applications you do not own or have permission to test.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">What you will configure<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">By the end of this guide, you will be able to:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Identify whether your Mac uses Apple Silicon or an Intel processor.<\/li>\n\n\n\n<li>Download and install the correct ZAP version.<\/li>\n\n\n\n<li>Open ZAP when macOS blocks the application.<\/li>\n\n\n\n<li>Update the installed ZAP add-ons.<\/li>\n\n\n\n<li>Configure ZAP\u2019s local proxy listener.<\/li>\n\n\n\n<li>Launch a browser through ZAP.<\/li>\n\n\n\n<li>Capture HTTP and HTTPS requests.<\/li>\n\n\n\n<li>Configure a browser manually when necessary.<\/li>\n\n\n\n<li>install the ZAP Root CA certificate for HTTPS testing.<\/li>\n\n\n\n<li>Perform passive and authorised active scans.<\/li>\n\n\n\n<li>Review security alerts.<\/li>\n\n\n\n<li>Generate an HTML or PDF report.<\/li>\n\n\n\n<li>Save your ZAP testing session.<\/li>\n\n\n\n<li>Troubleshoot common macOS problems.<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 1: Check whether your Mac uses Apple Silicon or Intel<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP provides different macOS installers for Apple Silicon and Intel Macs. Installing the correct version helps avoid performance and compatibility problems.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Method 1: Check through About This Mac<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Click the <strong>Apple menu<\/strong> in the upper-left corner.<\/li>\n\n\n\n<li>Select <strong>About This Mac<\/strong>.<\/li>\n\n\n\n<li>Look for the field labelled <strong>Chip<\/strong> or <strong>Processor<\/strong>.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">You may see one of the following:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Apple M1<\/li>\n\n\n\n<li>Apple M2<\/li>\n\n\n\n<li>Apple M3<\/li>\n\n\n\n<li>Apple M4<\/li>\n\n\n\n<li>Intel Core i5<\/li>\n\n\n\n<li>Intel Core i7<\/li>\n\n\n\n<li>Intel Core i9<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Any Mac using an M1, M2, M3, or M4 processor is an <strong>Apple Silicon Mac<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A Mac displaying Intel Core is an <strong>Intel Mac<\/strong>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Method 2: Check through Terminal<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Open Terminal by pressing:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Command + Space\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Search for:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Terminal\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Then run:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>uname -m\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Interpret the result as follows:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>arm64    = Apple Silicon Mac\nx86_64   = Intel Mac\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Keep this information ready when selecting the ZAP installer.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 2: Install ZAP using the official macOS installer<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">For beginners, the official macOS installer is the recommended installation method.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Open the official ZAP download page<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Open your normal browser and visit the official ZAP website\u2019s download section.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Look for the <strong>ZAP Stable<\/strong> section rather than Weekly, Nightly, or Cross Platform.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A stable release is the best choice for beginners because it is intended for normal use. Weekly and nightly versions may include newer features, but they can also contain incomplete or less-tested changes.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Select the correct macOS installer<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Choose the installer that matches your Mac.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">For Apple Silicon<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Select the option labelled similarly to:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>macOS Apple Silicon\naarch64\nARM64\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Use this version for M1, M2, M3, and M4 Macs.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">For Intel Mac<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Select the macOS Intel installer.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Do not download the Cross Platform package unless you specifically need it. The standard macOS installer already includes an appropriate Java runtime, while the Cross Platform package requires Java 17 or later to be installed separately.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Wait for the download to finish<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The installer will normally be saved in your Mac\u2019s <strong>Downloads<\/strong> folder.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Open Finder and navigate to:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Downloads\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The filename may look similar to:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ZAP_2_17_0_macos.dmg\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The exact version number may be newer if another stable release has been published.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4: Open the downloaded file<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Double-click the downloaded <code>.dmg<\/code> file.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Depending on the installer layout, you may see:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>An installation wizard, or<\/li>\n\n\n\n<li>A ZAP application icon that should be moved into Applications<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Follow the instructions shown on the screen.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When presented with a ZAP application icon and an Applications folder:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Drag <strong>ZAP<\/strong> into the <strong>Applications<\/strong> folder.<\/li>\n\n\n\n<li>Wait for macOS to finish copying the application.<\/li>\n\n\n\n<li>Close the installer window.<\/li>\n\n\n\n<li>Eject the mounted ZAP disk image from Finder.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Step 5: Open ZAP<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Open:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Finder \u2192 Applications\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Locate <strong>ZAP<\/strong> and double-click it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can also launch it using Spotlight:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Command + Space\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Type:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ZAP\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Then press Return.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 3: Fix \u201cZAP.app cannot be opened\u201d on macOS<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">The first time you open ZAP, macOS may display a message such as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u201cZAP.app\u201d cannot be opened because the developer cannot be verified.\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This can happen because macOS Gatekeeper does not recognise the application as coming from a verified Apple developer. The official ZAP download documentation describes this warning and the Open Anyway process.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Only continue when you downloaded ZAP from its official website.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Close the warning<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Click:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Cancel\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Open Privacy &amp; Security<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Open:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Apple menu \u2192 System Settings \u2192 Privacy &amp; Security\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Find the blocked application message<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Scroll down until you see a message stating that ZAP was blocked.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Click:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Open Anyway\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4: Confirm the action<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">macOS may ask for:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Your account password<\/li>\n\n\n\n<li>Touch ID<\/li>\n\n\n\n<li>Administrator approval<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Approve the request.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You may receive another warning. Click:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Open\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP should now start normally.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 4: Complete the first-start configuration<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">When ZAP starts for the first time, it may need a few moments to initialise its database, add-ons, interface, and certificate information.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Choose whether to save the session<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP may ask whether you want to persist the current session.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A session contains information such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Visited URLs<\/li>\n\n\n\n<li>HTTP requests and responses<\/li>\n\n\n\n<li>Discovered sites<\/li>\n\n\n\n<li>Security alerts<\/li>\n\n\n\n<li>Scan results<\/li>\n\n\n\n<li>Context information<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">For practice or temporary testing, select:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>No, I do not want to persist this session at this moment\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">For a real authorised assessment, select:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Yes, I want to persist this session\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Give the session a meaningful name, such as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>customer-portal-security-test\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">or:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>local-app-scan-2026-07-26\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Persisted sessions are stored locally and remain available after ZAP closes. Non-persisted sessions cannot be reopened after you exit the application.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Understand the main interface<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The ZAP window contains several important areas.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Sites tab<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The Sites tab displays applications, domains, folders, pages, scripts, and API endpoints discovered by ZAP.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">History tab<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The History tab displays every HTTP or HTTPS request sent through ZAP.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Request tab<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The Request tab shows what your browser or client sent to the server.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Response tab<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The Response tab shows what the server returned.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Alerts tab<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The Alerts tab displays potential security weaknesses identified by passive or active scanning.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Quick Start tab<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The Quick Start tab provides the simplest way to:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Explore an application manually<\/li>\n\n\n\n<li>Perform an automated scan<\/li>\n\n\n\n<li>Learn the basic ZAP workflow<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 5: Update ZAP and its add-ons<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP uses add-ons to provide many of its features, including scan rules, browser integration, spiders, report generation, authentication support, and API import capabilities.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Updating them before your first test ensures that you have the latest available fixes and security rules.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Open Manage Add-ons<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Click the marketplace-style button in the ZAP toolbar, or open:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Tools \u2192 Manage Add-ons\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Open the Installed tab<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Select:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Installed\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Click:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Check for Updates\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Install all available release-quality updates.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Open the Marketplace tab<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Select:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Marketplace\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Useful add-ons for beginners include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Passive Scan Rules<\/li>\n\n\n\n<li>Active Scan Rules<\/li>\n\n\n\n<li>Client Side Integration<\/li>\n\n\n\n<li>Client Spider<\/li>\n\n\n\n<li>Selenium<\/li>\n\n\n\n<li>macOS WebDrivers<\/li>\n\n\n\n<li>Report Generation<\/li>\n\n\n\n<li>OpenAPI Support<\/li>\n\n\n\n<li>GraphQL Support<\/li>\n\n\n\n<li>Postman Support<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Do not install every Alpha add-on simply because it is available. ZAP classifies add-ons as Release, Beta, or Alpha. Release add-ons are generally the most suitable starting point, while Alpha add-ons may still be experimental.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Restart ZAP when requested.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 6: Configure ZAP\u2019s operating mode<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP provides four operating modes:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Safe<\/li>\n\n\n\n<li>Protected<\/li>\n\n\n\n<li>Standard<\/li>\n\n\n\n<li>Attack<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">For a beginner, <strong>Protected mode<\/strong> is normally the safest practical choice.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Safe mode<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Safe mode prevents potentially dangerous functions such as active scanning, fuzzing, and request modification.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Use this while learning the interface or inspecting ordinary browser traffic.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Protected mode<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Protected mode permits potentially dangerous operations only against URLs that you have explicitly placed in scope.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is the recommended mode for controlled security testing.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Standard mode<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Standard mode does not place the same restrictions on potentially dangerous operations.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Beginners can accidentally scan the wrong application in Standard mode.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Attack mode<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Attack mode automatically scans newly discovered in-scope nodes. It should not be used by beginners until they fully understand ZAP\u2019s scope, context, and scanning behaviour.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The ZAP project recommends Protected mode to help ensure that users attack only the sites they intend to test.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Select Protected mode<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Find the mode selector in the ZAP toolbar.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Select:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Protected Mode\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If you are only learning how to capture traffic, you can begin with:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Safe Mode\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 7: Verify ZAP\u2019s local proxy configuration<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP acts as a local proxy server. Your browser sends requests to ZAP, and ZAP forwards them to the target application.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">By default, ZAP listens on:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Address: localhost\nPort: 8080\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">These settings can be viewed or changed through ZAP\u2019s Local Servers\/Proxies options.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Open the proxy settings<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In ZAP, open:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Tools \u2192 Options\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Expand:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Network\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Select:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Local Servers\/Proxies\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Check the address and port<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Confirm that the local proxy is configured as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Address: localhost\nPort: 8080\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You may also see the address represented as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>127.0.0.1\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Both refer to your own computer.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Keep remote access disabled<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Do not change the listener to:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>0.0.0.0\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">unless you understand the security implications and specifically need another authorised device to connect.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For normal testing on your Mac, keep the proxy bound to:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>localhost\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This prevents other devices on your network from connecting to your ZAP instance.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4: Change the port only when necessary<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If another application already uses port 8080, change the ZAP port to something such as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>8081\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">or:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>8090\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Remember that your browser proxy configuration must use the same port.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 8: The easiest way to connect a browser to ZAP<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">The easiest and safest method is to launch a browser directly from ZAP.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP automatically creates a temporary browser profile, configures the proxy, and handles certificate warnings. This means you normally do not need to change macOS network settings or install a root certificate manually.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Open Manual Explore<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In ZAP, select:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Quick Start\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Click:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Manual Explore\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Enter the authorised target URL<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">For example, when testing an application running locally:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>http:&#47;&#47;localhost:3000\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Other common local development addresses include:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>http:&#47;&#47;localhost:4200\nhttp:\/\/localhost:5173\nhttp:\/\/localhost:8000\nhttp:\/\/localhost:8080\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Do not use port 8080 for your application when ZAP itself is already listening on port 8080. In that case, either change your application\u2019s port or change ZAP\u2019s proxy port.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Select a browser<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Choose an installed browser such as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Firefox\nChrome\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4: Leave the HUD disabled initially<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The Heads Up Display can show ZAP information inside the browser, but it adds extra interface elements.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For your first test, leave:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Enable HUD\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">unchecked.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can enable it later after understanding the basic workflow.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 5: Launch the browser<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Click:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Launch Browser\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP will open a new browser window using a temporary testing profile.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Do not confuse this window with your normal browser profile. Your usual bookmarks, extensions, login sessions, and saved passwords may not appear.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 6: Browse the application<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Use the ZAP-launched browser to visit the application\u2019s:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Home page<\/li>\n\n\n\n<li>Login page<\/li>\n\n\n\n<li>Registration page<\/li>\n\n\n\n<li>User dashboard<\/li>\n\n\n\n<li>Forms<\/li>\n\n\n\n<li>Search pages<\/li>\n\n\n\n<li>Profile pages<\/li>\n\n\n\n<li>Settings<\/li>\n\n\n\n<li>File upload screens<\/li>\n\n\n\n<li>API-driven features<\/li>\n\n\n\n<li>Logout function<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The more of the application you explore, the more URLs and functionality ZAP can observe.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 9: Confirm that ZAP is capturing traffic<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Return to the ZAP desktop window.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Check the Sites tab<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">You should see the target domain or local application under:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Sites\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Expand the site tree to view discovered paths.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>localhost:3000\n\u251c\u2500\u2500 login\n\u251c\u2500\u2500 dashboard\n\u251c\u2500\u2500 profile\n\u251c\u2500\u2500 api\n\u2502   \u251c\u2500\u2500 users\n\u2502   \u2514\u2500\u2500 orders\n\u2514\u2500\u2500 logout\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Check the History tab<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The History tab should contain requests such as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>GET\nPOST\nPUT\nPATCH\nDELETE\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Click any request to inspect its details.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The lower section should display:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Request headers<\/li>\n\n\n\n<li>Request body<\/li>\n\n\n\n<li>Response headers<\/li>\n\n\n\n<li>Response body<\/li>\n\n\n\n<li>HTTP status code<\/li>\n\n\n\n<li>Cookies<\/li>\n\n\n\n<li>Parameters<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">If the Sites and History tabs contain entries, your browser is successfully sending traffic through ZAP. The official getting-started guidance uses these tabs as the confirmation that proxying is working.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 10: Understand passive scanning<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Passive scanning happens while traffic passes through ZAP.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It analyses requests and responses without deliberately sending attack payloads. Passive rules can identify issues such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Missing security headers<\/li>\n\n\n\n<li>Insecure cookies<\/li>\n\n\n\n<li>Information disclosure<\/li>\n\n\n\n<li>Cache-control weaknesses<\/li>\n\n\n\n<li>Potential cross-domain configuration problems<\/li>\n\n\n\n<li>Server version exposure<\/li>\n\n\n\n<li>Mixed-content conditions<\/li>\n\n\n\n<li>Weak browser-security configuration<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Passive scanning is safer than active scanning because it examines existing traffic instead of attacking the application.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Open the <strong>Alerts<\/strong> tab after browsing several pages. You may already see findings created by the passive scanner. ZAP\u2019s passive scanner examines HTTP and WebSocket messages that pass through or are sent by ZAP.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 11: Manually configure Firefox to use ZAP<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Launching a browser from ZAP is the recommended method. Manual configuration is useful when you need:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Your existing browser profile<\/li>\n\n\n\n<li>A specific browser extension<\/li>\n\n\n\n<li>An existing authenticated session<\/li>\n\n\n\n<li>A browser configuration ZAP cannot launch automatically<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Open Firefox settings<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In Firefox, open:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Firefox \u2192 Settings\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Find Network Settings<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Under the General section, scroll to:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Network Settings\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Click:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Settings\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Select manual proxy configuration<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Choose:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Manual proxy configuration\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Enter:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>HTTP Proxy: 127.0.0.1\nPort: 8080\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Configure HTTPS traffic to use the same proxy. Depending on the Firefox version, this may appear as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Also use this proxy for HTTPS\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">or as a separate HTTPS Proxy field.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Use:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>HTTPS Proxy: 127.0.0.1\nPort: 8080\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4: Consider localhost testing<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Some browser configurations bypass the proxy for localhost.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When testing a local application, check the field containing proxy exceptions. Remove <code>localhost<\/code> or <code>127.0.0.1<\/code> from the exception list when necessary.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP\u2019s documentation notes that newer Firefox versions may require the following preference to proxy localhost traffic:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>network.proxy.allow_hijacking_localhost\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Open:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>about:config\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Search for that preference and set it to:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>true\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Only change this setting in a dedicated testing profile.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 5: Save the settings<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Click:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>OK\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Keep ZAP running whenever Firefox is configured to use it. Otherwise, Firefox will be unable to reach websites.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 12: Configure Chrome or Safari through macOS<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Chrome and Safari can use the macOS network proxy settings.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Be aware that this method may affect other applications on your Mac, not just the browser. The ZAP-launched browser method is generally safer and easier.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Open network settings<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Open:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Apple menu \u2192 System Settings \u2192 Network\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Select your active connection<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Select the network service currently in use, such as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Wi-Fi\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">or:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Ethernet\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Click:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Details\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Open Proxies<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Select:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Proxies\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Apple documents this path as System Settings, Network, the active network service, Details, and Proxies.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4: Enable the HTTP proxy<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Enable:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Web Proxy (HTTP)\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Enter:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Server: 127.0.0.1\nPort: 8080\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 5: Enable the HTTPS proxy<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Enable:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Secure Web Proxy (HTTPS)\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Enter:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Server: 127.0.0.1\nPort: 8080\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Leave username and password empty because the local ZAP proxy does not normally require proxy authentication.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 6: Review the bypass list<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">When testing an application on localhost, make sure that the proxy bypass list does not contain:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>localhost\n127.0.0.1\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Also consider disabling:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Exclude simple hostnames\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">during local testing.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 7: Save the configuration<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Click:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>OK\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">or:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Done\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Keep ZAP running while these proxy settings are enabled.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Important: Disable the proxy when testing is finished<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Return to the same Proxies screen and disable:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Web Proxy (HTTP)\nSecure Web Proxy (HTTPS)\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Otherwise, your Mac may appear to lose internet access after ZAP is closed.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 13: Configure HTTPS interception<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">HTTPS traffic is encrypted. To inspect it, ZAP generates temporary certificates for the sites being tested and signs them using its own Root CA certificate.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Browsers do not normally trust this private ZAP certificate. That is why a manually configured browser may display errors such as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Your connection is not private\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">or:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Unknown issuer\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Browsers launched directly from ZAP are configured to handle these certificate errors automatically. Manual certificate installation is needed only when you use your own browser profile or another HTTP client.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 14: Export the ZAP Root CA certificate<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Open ZAP options<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In ZAP, open:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Tools \u2192 Options\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Open Server Certificates<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Navigate to:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Network \u2192 Server Certificates\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Save the certificate<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Click:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Save\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Save the file with a clear name:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>zap_root_ca.cer\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Store it temporarily in:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Downloads\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP creates a unique Root CA certificate when it first runs. The certificate should only be installed in clients that you intentionally want to route through ZAP.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 15: Trust the ZAP certificate in macOS Keychain<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">This step allows Safari, Chrome, and other applications using the macOS certificate store to accept certificates generated by ZAP.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Open Keychain Access<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Press:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Command + Space\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Search for:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Keychain Access\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Open the application.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Select the login keychain<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In the left sidebar, select:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>login\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Using the login keychain limits the certificate to your macOS user account. The System keychain affects all users and usually requires administrator approval.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Import the certificate<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Drag the following file into Keychain Access:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>zap_root_ca.cer\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Alternatively, use:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>File \u2192 Import Items\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Apple officially supports adding certificates by selecting a login or System keychain and dragging the certificate into Keychain Access.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4: Find the certificate<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Search for:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ZAP Root CA\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">or:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Zed Attack Proxy Root CA\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 5: Change the trust setting<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Double-click the certificate.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Expand:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Trust\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Change:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>When using this certificate\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">to:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Always Trust\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Close the certificate window.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Enter your macOS password or use Touch ID when requested. Apple allows certificate trust policies to be changed from the Trust section in Keychain Access.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 6: Restart the browser<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Completely quit Chrome or Safari:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Command + Q\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Then reopen it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">HTTPS pages passing through ZAP should now load without certificate warnings.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 16: Import the certificate directly into Firefox when needed<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Modern Firefox versions can use third-party certificates installed in the macOS certificate store. However, if Firefox still displays certificate errors, import the certificate into Firefox directly.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Open Firefox settings<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Open:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Firefox \u2192 Settings\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Open Privacy &amp; Security<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Select:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Privacy &amp; Security\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Find Certificates<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Scroll to:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Certificates\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Click:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>View Certificates\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4: Open Authorities<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Select:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Authorities\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Click:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Import\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 5: Select the certificate<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Choose:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>zap_root_ca.cer\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">When prompted, enable trust for identifying websites.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Click:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>OK\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Restart Firefox.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 17: Understand the certificate risk<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Installing a private Root CA certificate is a sensitive security change.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Anyone possessing the corresponding private key could potentially create certificates trusted by your browser. The ZAP documentation warns that trusting a self-generated Root CA introduces an additional attack surface.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Use the following precautions:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Install the certificate only on a testing machine or testing account.<\/li>\n\n\n\n<li>Prefer a dedicated browser profile.<\/li>\n\n\n\n<li>Never share the ZAP certificate\u2019s private key.<\/li>\n\n\n\n<li>Do not install certificates received from unknown people.<\/li>\n\n\n\n<li>Remove the certificate when it is no longer required.<\/li>\n\n\n\n<li>Do not use a ZAP-testing browser profile for online banking or personal email.<\/li>\n\n\n\n<li>Prefer ZAP\u2019s automatically launched browser when possible.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">To remove the certificate:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open Keychain Access.<\/li>\n\n\n\n<li>Search for ZAP Root CA.<\/li>\n\n\n\n<li>Select the certificate.<\/li>\n\n\n\n<li>Press Delete.<\/li>\n\n\n\n<li>Confirm its removal.<\/li>\n\n\n\n<li>Restart your browser.<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 18: Add the target application to scope<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Scope tells ZAP which application you are authorised to test.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is particularly important when using Protected mode.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Browse the application<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Launch a browser from ZAP and open the target application.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Locate it in the Sites tab<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Return to ZAP.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Under the Sites tab, find the target domain.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Create a context<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Right-click the target site and select an option similar to:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Include in Context \u2192 New Context\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Give the context a meaningful name:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Local Test Application\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">or:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Staging Customer Portal\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4: Mark the site as in scope<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Right-click the site and select:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Include in Scope\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">A scope indicator should appear beside the site.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 5: Confirm Protected mode<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Check that ZAP remains in:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Protected Mode\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP should now allow dangerous operations only against the authorised in-scope application.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Be careful when the target page loads resources from third-party domains such as analytics platforms, CDNs, payment providers, or social-media services. Do not add those external domains to scope unless you are specifically authorised to test them.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 19: Perform your first passive security assessment<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">A beginner should start with passive testing before running an active scan.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Launch the target through ZAP<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Open:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Quick Start \u2192 Manual Explore\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Enter your authorised application URL and launch a browser.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Explore every authorised feature<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Navigate through the application manually.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For authenticated testing:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open the login page.<\/li>\n\n\n\n<li>Sign in using a dedicated test account.<\/li>\n\n\n\n<li>Visit all permitted application sections.<\/li>\n\n\n\n<li>Submit authorised forms.<\/li>\n\n\n\n<li>Use search and filtering functions.<\/li>\n\n\n\n<li>Open profile and account settings.<\/li>\n\n\n\n<li>Perform ordinary test transactions.<\/li>\n\n\n\n<li>Log out.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Avoid using real production customer data.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Wait for passive scanning<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Return to ZAP and allow the passive-scan queue to complete.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can usually see scanning activity in the status area.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4: Review the Alerts tab<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Expand the Alerts tree and inspect each finding.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A typical alert contains:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Alert name<\/li>\n\n\n\n<li>Risk level<\/li>\n\n\n\n<li>Confidence level<\/li>\n\n\n\n<li>Affected URL<\/li>\n\n\n\n<li>Parameter<\/li>\n\n\n\n<li>Evidence<\/li>\n\n\n\n<li>Description<\/li>\n\n\n\n<li>Recommended solution<\/li>\n\n\n\n<li>Reference material<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Treat scanner findings as leads requiring validation. An automated tool may produce false positives, and it may miss vulnerabilities based on application logic or business rules.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 20: Run your first authorised automated scan<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">An automated scan normally combines application discovery with active security testing.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Only continue against an authorised test target.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Open Automated Scan<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In ZAP, select:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Quick Start \u2192 Automated Scan\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Enter the target URL<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>http:&#47;&#47;localhost:3000\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">or an authorised staging URL.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Double-check the hostname before continuing.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Select the spider<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP may offer:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Traditional Spider<\/li>\n\n\n\n<li>Client Spider<\/li>\n\n\n\n<li>AJAX Spider<\/li>\n\n\n\n<li>Automatic selection<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The Traditional Spider is fast and discovers links from conventional HTML.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A modern browser-driven spider is more appropriate for applications that depend heavily on JavaScript. ZAP\u2019s Quick Start documentation explains that a modern spider launches a browser and interacts with links, while the traditional spider cannot fully handle JavaScript-heavy applications.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For a conventional server-rendered website, start with:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Traditional Spider\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">For a React, Angular, Vue, or other single-page application, use a modern spider such as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Client Spider\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Using both can improve application coverage.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4: Verify the scan policy<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">For the first scan, use a standard or default scan policy.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Do not immediately increase every rule to maximum strength. Stronger settings generate more requests, take longer, and may place more load on the application.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 5: Start the scan<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Click:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Attack\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP will begin:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Discovering application pages and endpoints<\/li>\n\n\n\n<li>Sending active test requests<\/li>\n\n\n\n<li>Analysing responses<\/li>\n\n\n\n<li>Recording potential vulnerabilities<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Step 6: Monitor the scan<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Watch the following tabs:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Spider\nActive Scan\nSites\nHistory\nAlerts\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You can stop the scan when:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>You selected the wrong target<\/li>\n\n\n\n<li>The application becomes unstable<\/li>\n\n\n\n<li>The server experiences excessive load<\/li>\n\n\n\n<li>Unexpected data changes occur<\/li>\n\n\n\n<li>You discover that the scope is incorrect<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 21: Review the findings correctly<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP findings are commonly grouped by risk level.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">High risk<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Potentially serious vulnerabilities requiring urgent investigation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Examples may include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>SQL injection<\/li>\n\n\n\n<li>Remote code execution conditions<\/li>\n\n\n\n<li>Serious authentication weaknesses<\/li>\n\n\n\n<li>High-impact cross-site scripting<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Medium risk<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Important security weaknesses that should be investigated and remediated.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Low risk<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Lower-impact weaknesses or defence-in-depth opportunities.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Informational<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Observations that may not represent direct vulnerabilities but can provide useful security context.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Confidence level<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Risk and confidence are different.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Risk<\/strong> estimates potential impact.<\/li>\n\n\n\n<li><strong>Confidence<\/strong> indicates how certain ZAP is that the issue exists.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">A High-risk finding with Low confidence needs careful manual verification. An Informational alert with High confidence may be accurate but have limited direct impact.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Do not send a raw ZAP report to developers without reviewing it. Validate each important finding and add:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Reproduction steps<\/li>\n\n\n\n<li>Screenshots<\/li>\n\n\n\n<li>Affected parameter<\/li>\n\n\n\n<li>Request and response evidence<\/li>\n\n\n\n<li>Business impact<\/li>\n\n\n\n<li>Recommended remediation<\/li>\n\n\n\n<li>Verification after the fix<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Automated active scanning cannot discover every vulnerability, particularly business-logic and some access-control weaknesses. Manual security testing remains necessary.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 22: Generate a ZAP security report<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP can generate reports in formats including HTML, JSON, Markdown, XML, and PDF, depending on the installed report templates.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Open the report generator<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Open:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Report \u2192 Generate Report\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Enter the report title<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Customer Portal Security Assessment\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Enter a report filename<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>customer-portal-zap-report.html\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4: Select the report directory<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Choose a folder such as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Documents\/Security-Reports\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 5: Select the target<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Under Sites or Contexts, select only the application you tested.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This prevents unrelated traffic from appearing in the report.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 6: Select a template<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">For beginners, choose an HTML report such as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Risk and Confidence HTML\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">or:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Traditional HTML\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">HTML is normally easier to review than raw JSON or XML.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 7: Choose included risks<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Include:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>High\nMedium\nLow\nInformational\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">For an executive report, you may later create a separate version containing only High and Medium findings.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 8: Generate the report<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Click:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Generate Report\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Open the resulting file in your browser and review it before sharing.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Reports can contain sensitive information, including:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Internal URLs<\/li>\n\n\n\n<li>Request parameters<\/li>\n\n\n\n<li>Session information<\/li>\n\n\n\n<li>Application paths<\/li>\n\n\n\n<li>Vulnerability evidence<\/li>\n\n\n\n<li>Portions of HTTP responses<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Store reports securely and share them only with authorised recipients.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 23: Save and reopen your ZAP session<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">If you did not persist the session when ZAP started, you can save it later.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Open:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>File \u2192 Persist Session\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Choose a secure location and meaningful name.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Once a session is persisted, ZAP continually records subsequent changes. You do not need to repeatedly click Save.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To open an existing session later, use the appropriate Open Session option from the File menu.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Avoid saving sensitive testing sessions in cloud-synchronised folders unless your organisation permits it.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 24: Optional Homebrew installation<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Users comfortable with Terminal can install ZAP using Homebrew.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When Homebrew is already installed, run:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>brew install --cask zap\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Launch ZAP with:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>open -a ZAP\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Check the installed cask information:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>brew info --cask zap\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Upgrade it with:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>brew upgrade --cask zap\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Remove it with:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>brew uninstall --cask zap\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The ZAP download page currently lists Homebrew Cask as a macOS installation option. However, as of 26 July 2026, the Homebrew package page marks the ZAP cask as deprecated with a scheduled disable date of 1 September 2026. For a guide intended to remain usable beyond that date, the official ZAP macOS installer is the safer primary method.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 25: Start ZAP from Terminal<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">When ZAP is installed under Applications, its command-line script can be run from:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/Applications\/ZAP.app\/Contents\/Java\/zap.sh\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Start the normal desktop interface:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/Applications\/ZAP.app\/Contents\/Java\/zap.sh\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Display the help:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/Applications\/ZAP.app\/Contents\/Java\/zap.sh -help\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Display support information:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/Applications\/ZAP.app\/Contents\/Java\/zap.sh -suppinfo\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Update installed add-ons:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/Applications\/ZAP.app\/Contents\/Java\/zap.sh -addonupdate\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The official documentation identifies this script as the command-line entry point for a ZAP application installed in <code>\/Applications<\/code>.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 26: Troubleshoot common problems<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">Problem 1: ZAP does not open<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Possible solution<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Open:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>System Settings \u2192 Privacy &amp; Security\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Find the blocked application message and click:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Open Anyway\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Verify that you downloaded the correct Apple Silicon or Intel installer.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Problem 2: Browser launched from ZAP cannot be found<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Possible causes<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Chrome or Firefox is not installed.<\/li>\n\n\n\n<li>Selenium add-ons are missing.<\/li>\n\n\n\n<li>The macOS WebDrivers add-on is missing.<\/li>\n\n\n\n<li>Browser or WebDriver versions are incompatible.<\/li>\n\n\n\n<li>ZAP add-ons are outdated.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Solution<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Open:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Tools \u2192 Manage Add-ons\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Install or update:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Selenium\nmacOS WebDrivers\nClient Side Integration\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Restart ZAP and try again.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP\u2019s macOS WebDrivers add-on provides browser drivers used for supported Chrome and Firefox browser automation.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Problem 3: The browser has no internet connection<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Check the following:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Is ZAP running?<\/li>\n\n\n\n<li>Is ZAP listening on port 8080?<\/li>\n\n\n\n<li>Does the browser use <code>127.0.0.1:8080<\/code>?<\/li>\n\n\n\n<li>Is another application already using port 8080?<\/li>\n\n\n\n<li>Did you close ZAP while macOS proxy settings remained enabled?<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">When testing is complete, disable the manually configured HTTP and HTTPS proxies.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Problem 4: Nothing appears in Sites or History<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Check that:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>You launched the browser from ZAP.<\/li>\n\n\n\n<li>The manually configured browser uses the correct proxy.<\/li>\n\n\n\n<li>The ZAP proxy port matches the browser proxy port.<\/li>\n\n\n\n<li>The target application is running.<\/li>\n\n\n\n<li>The browser is not bypassing localhost.<\/li>\n\n\n\n<li>A VPN, security agent, or corporate proxy is not overriding the settings.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">When browser traffic is routed correctly, requests should appear in both Sites and History.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Problem 5: HTTPS pages show certificate errors<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Use one of these solutions:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Launch the browser directly from ZAP.<\/li>\n\n\n\n<li>Export and trust the ZAP Root CA in Keychain Access.<\/li>\n\n\n\n<li>Import the Root CA directly into Firefox.<\/li>\n\n\n\n<li>Restart the browser after installing the certificate.<\/li>\n\n\n\n<li>Regenerate an expired ZAP Root CA certificate.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP-generated Root CA certificates are valid for a limited period and may eventually need to be regenerated.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Problem 6: Localhost traffic is not captured<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">For Firefox, check:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>network.proxy.allow_hijacking_localhost\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Set it to:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>true\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">For macOS system proxies:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Remove localhost from the bypass list.<\/li>\n\n\n\n<li>Remove <code>127.0.0.1<\/code> from the bypass list.<\/li>\n\n\n\n<li>Disable Exclude Simple Hostnames if necessary.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The safest alternative is to launch the browser directly through ZAP.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Problem 7: Port 8080 is already in use<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Check which process uses the port:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>lsof -i :8080\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Either stop the conflicting application or change ZAP to another port, such as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>8081\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Then update the browser proxy to use the same new port.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Problem 8: ZAP is using too much memory<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Large applications, long testing sessions, modern browser spiders, and active scans can use significant memory.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Try the following:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Close unnecessary browser tabs.<\/li>\n\n\n\n<li>Test one application at a time.<\/li>\n\n\n\n<li>Reduce active-scan concurrency.<\/li>\n\n\n\n<li>Avoid installing unnecessary add-ons.<\/li>\n\n\n\n<li>Start a fresh ZAP session.<\/li>\n\n\n\n<li>Scan a smaller application scope.<\/li>\n\n\n\n<li>Exclude static resources where appropriate.<\/li>\n\n\n\n<li>Close other memory-intensive applications.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Recommended beginner configuration<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">The following settings provide a practical and relatively safe starting point:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ZAP version: Latest stable release\nInstallation: Official macOS installer\nMode: Protected\nProxy address: localhost\nProxy port: 8080\nBrowser method: Launch from ZAP\nCertificate installation: Not required for ZAP-launched browser\nInitial testing: Passive scan\nActive scan: Authorised test environments only\nSpider: Traditional plus Client Spider for modern applications\nReports: HTML\nSessions: Persist for real assessments\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Beginner workflow summary<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Use this sequence whenever you begin a new authorised assessment:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>1. Start ZAP.\n2. Persist the session when results must be saved.\n3. Update ZAP add-ons.\n4. Select Protected mode.\n5. Launch a browser from Quick Start.\n6. Open the authorised target application.\n7. Add the application to scope.\n8. Browse all permitted application functions.\n9. Review passive alerts.\n10. Run a spider if additional discovery is needed.\n11. Run an active scan only with permission.\n12. Validate important findings manually.\n13. Generate an HTML report.\n14. Save the session.\n15. Close the testing browser.\n16. Remove manual proxy settings when used.\n17. Remove the Root CA when it is no longer needed.\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Final thoughts<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Installing ZAP on macOS is straightforward, but using it safely requires understanding three important concepts:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>The browser must send its traffic through ZAP.<\/strong><\/li>\n\n\n\n<li><strong>HTTPS inspection requires temporary certificate trust.<\/strong><\/li>\n\n\n\n<li><strong>Active scanning must be limited to authorised systems.<\/strong><\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">For beginners, the best approach is to install the official stable macOS release, select Protected mode, and use the browser-launch function under Quick Start. This automatically configures the browser proxy and certificate handling, avoiding most common setup problems.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">After confirming that requests appear in the Sites and History tabs, begin with passive scanning. Move to spiders and active scanning only after establishing the correct scope and confirming that the target is a dedicated, authorised testing environment.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP is powerful enough for experienced penetration testers, yet its Quick Start workflow makes it accessible to developers, testers, DevOps engineers, and security newcomers. With the configuration in this guide, you will have a safe foundation for learning web application security testing on macOS.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Last updated: 26 July 2026 ZAP, formerly known as OWASP ZAP, is a free and open-source web application security testing tool. It can act as a proxy&#8230; <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1039","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/1039","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/comments?post=1039"}],"version-history":[{"count":1,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/1039\/revisions"}],"predecessor-version":[{"id":1040,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/1039\/revisions\/1040"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/media?parent=1039"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/categories?post=1039"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/tags?post=1039"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}