Vulnerability Scanning with OWASP ZAP

Scan a vulnerable web app and generate a professional security report.

Introduction

30 Second Summary

Every website you visit stores personal data behind code that could have security holes. Professional security teams use automated scanners to find these vulnerabilities before attackers do.

In this project, you will use OWASP ZAP to scan a deliberately vulnerable web application and generate a professional security report documenting real vulnerabilities like SQL Injection and Cross-Site Scripting.

What You'll Build

You'll launch a vulnerable web app in Docker, run an automated vulnerability scan with OWASP ZAP, and export a professional HTML report categorizing every security flaw by risk level.

By the end of this project, you'll have:

A running DVWA (Damn Vulnerable Web Application) instance in Docker that simulates a real vulnerable website.
A completed vulnerability scan with alerts categorized by risk level (High, Medium, Low, Informational).
A professional HTML security report documenting every vulnerability found, complete with risk ratings and remediation advice.
Secret Mission: Run an authenticated scan to discover deeper vulnerabilities hidden behind login pages.

Are there any prerequisites?

You'll need Docker Desktop already installed on Windows. Basic familiarity with network protocols (like from Project 1: Network Traffic Analysis with Wireshark) is helpful but not required.

Install Java and OWASP ZAP

OWASP ZAP is the scanning engine you'll use to automatically discover vulnerabilities in web applications. Before you can run ZAP, you need Java installed on your machine because ZAP is built on it.

In this step, you'll install Oracle JDK 21 (the Java runtime ZAP requires) and OWASP ZAP 2.17.0 itself. By the end, ZAP will be open and ready for your first scan.

In this step, get ready to:

Install Oracle JDK 21 on Windows.
Install OWASP ZAP 2.17.0.
Launch ZAP and configure it for your first session.

Download and install Oracle JDK 21

ZAP requires Java 17 or higher to run. Oracle JDK 21 is free under the Oracle No-Fee Terms and Conditions License, making it the simplest choice for this project.

Open your browser and navigate to the Oracle Java Downloads page:
https://www.oracle.com/java/technologies/downloads/
Scroll to the Java 21 section and click the Windows tab.
Download the file jdk-21_windows-x64_bin.exe.
Once downloaded, double-click the installer file to launch it.
Accept the default settings on each screen and click Next until the installation completes.

Why Oracle JDK 21?

ZAP requires Java 17 or higher. Oracle JDK 21 is available under the Oracle No-Fee Terms and Conditions License, which permits free use for all users.

JDK 17 (versions 17.0.13 and later) requires a different license with restrictions, so JDK 21 is simpler for learners.

Now you need to verify that Java was installed correctly. You must open a new Command Prompt for the PATH changes from the installer to take effect.

Press the Windows key to open your search bar.
Type Command Prompt and press Enter to open it.
Verify Java is installed by running this command:

java -version

✔️ I see version 21 or higher

You should see output mentioning version 21. Java is installed correctly and you're ready to move on.

ⓧ I see an older version

An older Java installation is taking priority on your system PATH. The Oracle JDK 21 installer adds its executables to a specific PATH location, but an existing Java may appear earlier in PATH.

Open Settings, then Apps, then Installed apps.
Search for the older Java version and uninstall it.
Close your Command Prompt and open a new one.
Run java -version again to confirm version 21 appears.

Still seeing an older version?

If uninstalling the old version didn't help, you may need to manually update your PATH. Search for Environment Variables in the Windows search bar, open it, and check the Path variable under System variables.

Make sure C:\Program Files\Common Files\Oracle\Java\javapath appears before any older Java path entries.

help me fix my Java PATH so version 21 is recognized

ⓧ Command not recognized

If you see an error saying the command is not recognized, the most common cause is that you opened Command Prompt before the installation finished, or you reused an old Command Prompt window.

Close your current Command Prompt window completely.
Open a brand new Command Prompt (press the Windows key, type Command Prompt, press Enter).
Run java -version again.

If it still doesn't work, the installer may not have added Java to your PATH. Search for Environment Variables in the Windows search bar. Under System variables, find Path and click Edit. Add a new entry: C:\Program Files\Common Files\Oracle\Java\javapath. Click OK on all dialogs, then open a new Command Prompt and try again.

Still not working?

help me troubleshoot Java not being recognized in Command Prompt after installing Oracle JDK 21

Download and install OWASP ZAP 2.17.0

OWASP ZAP is the world's most widely used open-source web application scanner. It will be your primary tool for discovering vulnerabilities throughout this project.

Open your browser and navigate to the ZAP download page:
https://www.zaproxy.org/download/
Find the Windows (64) Installer option (244 MB) and click to download it.
Once downloaded, double-click the installer file to run it.
Accept the license agreement when prompted.
Select Standard when asked for the installation type.
Click Finish when the installation completes.

What is OWASP ZAP?

OWASP ZAP (Zed Attack Proxy) is a free, open-source security tool maintained by the OWASP community. Security professionals use it to find vulnerabilities in web applications by automatically crawling pages and testing them for common weaknesses.

Installer won't run?

Make sure you completed the Java installation first. ZAP requires Java 17 or higher to run, and the installer will fail if Java is missing.

If Windows SmartScreen blocks the installer, click More info and then Run anyway.

help me troubleshoot the OWASP ZAP installer not running on Windows

Launch ZAP

With both Java and ZAP installed, you can now launch ZAP for the first time. The first launch includes a couple of one-time setup prompts.

Press the Windows key to open your search bar.
Type ZAP and press Enter to open OWASP ZAP.
On first launch, accept the license terms when prompted.
When prompted about session persistence, select No, I do not want to persist this session.

Why skip session persistence?

ZAP can save your scan sessions to disk for later review. For this learning project, skipping persistence keeps things simple. You can always save a session manually later if needed.

ZAP opens to the Quick Start tab. You should see two large buttons: Automated Scan and Manual Explore.

ZAP won't launch?

If ZAP shows an error on launch, confirm Java is correctly installed by opening a new Command Prompt and running java -version. ZAP needs Java 17 or higher.

If ZAP starts loading but takes a long time, be patient on first launch. ZAP downloads add-on updates in the background, which can take a minute or two.

help me get OWASP ZAP to launch on Windows

Your security toolkit is ready. Next up, you'll launch a deliberately vulnerable web application to give ZAP something to scan.

Launch DVWA in Docker

Your security scanner is installed and ready to go. Now you need a target to scan.

In this step, you'll launch DVWA (Damn Vulnerable Web Application), a web app intentionally built with security flaws for testing. This gives OWASP ZAP a safe, legal target full of real vulnerabilities to discover.

In this step, get ready to:

Run a Docker container with DVWA.
Set up the DVWA database and log in.
Lower the security level so vulnerabilities are fully exposed.

Run the DVWA container

DVWA is a PHP/MySQL web application designed to be full of security holes. You'll run it inside a Docker container so it stays isolated on your machine.

Open a new Command Prompt window.
Pull and start the DVWA container by running this command:

docker run -d -p 80:80 --name dvwa vulnerables/web-dvwa

What does this command do?

docker run downloads the image (if needed) and starts a new container.
-d runs the container in the background so you can keep using your terminal.
-p 80:80 maps port 80 on your machine to port 80 inside the container.
--name dvwa gives the container a friendly name you can reference later.

Wait for the image to download. This may take a minute on the first run.
Once you see a long container ID printed in the terminal, open your browser.
Navigate to http://localhost in the address bar.

You should see the DVWA Database Setup page with a Setup Check section and a Create / Reset Database button at the bottom.

Don't see the DVWA setup page?

Make sure Docker Desktop is running. Look for the Docker whale icon in your system tray.
If you see "port is already allocated", another service is using port 80. Stop it or use -p 8080:80 instead, then visit http://localhost:8080.
If the page takes a while to load, the container may still be starting up. Wait 10-15 seconds and refresh.

Need more help? Help me troubleshoot why DVWA isn't loading at localhost

Create the database and log in

DVWA needs a one-time database setup before you can use it. This creates the tables that store the vulnerable application's data.

On the DVWA setup page, scroll to the bottom.
Click the Create / Reset Database button.
After the database is created, DVWA redirects you to the login page.
Enter admin in the Username field.
Enter password in the Password field.
Click Login.

You should now see the DVWA home page with a menu on the left side listing various vulnerability modules.

Why use default credentials?

DVWA ships with known default credentials because it is designed for security testing, not production use. In the real world, default credentials are one of the most common security misconfigurations that scanners flag.

Set the security level to Low

DVWA has multiple security levels that control how much input filtering is applied. Setting it to Low removes all defences so ZAP can detect vulnerabilities clearly.

In the left menu, click DVWA Security.
In the Security Level dropdown, select Low.
Click Submit.

The page confirms the security level is now set to Low.

Why set security to Low?

DVWA defaults to the Impossible security level, which blocks most attacks. At Low, there is no input filtering at all. This means vulnerabilities like SQL Injection and Cross-Site Scripting are fully exploitable.

For a first scan, you want the clearest possible results. Low security ensures ZAP finds the most vulnerabilities without interference.

Don't see DVWA Security in the menu?

Make sure you are logged in. If you see the login page, enter admin / password again.
Check that you clicked Create / Reset Database in the earlier substep. Without the database, DVWA cannot load its pages.

Still stuck? Help me get DVWA Security settings working

Your vulnerable target is live and wide open. Next up, you'll point ZAP at DVWA and let it loose to discover real security flaws.

Run the Automated Scan

In the previous step, you launched DVWA and configured it to expose all of its vulnerabilities. Now it is time to unleash an automated scanner on it.

ZAP's Automated Scan combines three phases into one workflow: crawling the application to discover pages, passively scanning those pages for obvious issues, and then actively attacking every discovered page with known exploits. You will kick off this entire process with a single button click.

In this step, get ready to:

Launch ZAP's automated scan against DVWA.
Watch the spider and active scan phases work in real-time.
Review security alerts as they appear, grouped by risk level.

Launch the automated scan

ZAP's Quick Start Automated Scan discovers every page it can find, then probes each one for security flaws. You will point it at your local DVWA instance.

Switch back to the ZAP window. You should still be on the Quick Start tab.
Click the large Automated Scan button.
In the URL to attack text box, enter http://localhost.
Leave the Use traditional spider checkbox selected.
Click the Attack button.

What are passive and active scanning?

ZAP runs two scanning phases back-to-back. Passive scanning examines the responses your application sends without modifying anything. It is safe and non-intrusive.

Active scanning attempts to find vulnerabilities by using known attacks against discovered pages. It is a real attack on the target, which is why you should only ever run it against applications you own or have permission to test.

What is the traditional spider?

The traditional spider discovers links by examining the HTML in responses from the web application. It is fast and effective for traditional HTML-based apps like DVWA.

ZAP also offers an AJAX spider for JavaScript-heavy apps, but DVWA is a standard PHP application, so the traditional spider works perfectly here.

Watch ZAP crawl and attack

Once you click Attack, ZAP starts working through two visible phases. The scan takes approximately 5-10 minutes to complete on DVWA.

Look at the bottom panel of ZAP. Click the Spider tab to watch ZAP crawl DVWA's pages and discover links.
Click the Active Scan tab in the same bottom panel to watch ZAP probe each discovered page for vulnerabilities.
Watch the progress bar at the top. The scan is complete when it reaches 100%.

What is happening during the scan?

First, the spider follows every link it can find in DVWA, building a complete map of the application. This is similar to how a search engine crawls a website.

Once the spider finishes, the active scanner takes over. It sends specially crafted inputs (like SQL injection strings and XSS payloads) to every form and parameter it discovered, checking if the application responds in a way that reveals a vulnerability.

Let the scan run in the background

You do not need to watch every request. Feel free to let ZAP work while you continue to the next substep. The alerts appear in real-time, so you can start reviewing them before the scan finishes.

Explore alerts as they appear

As ZAP discovers vulnerabilities, it logs them as alerts. Each alert includes a risk rating so you can prioritize what matters most.

Look at the Alerts tab on the left side of ZAP (in the panel above the Spider/Active Scan tabs).
Notice that alerts are grouped by risk level using colored flags.
Click on any alert to see its details in the right panel.

What do the colored flags mean?

Red (High) means a critical vulnerability. An attacker could steal data or take control.
Orange (Medium) means a vulnerability that could be exploited with some effort.
Yellow (Low) means a minor issue or information disclosure.
Blue (Informational) means a finding that is not directly exploitable but worth noting.

Once the progress bar reaches 100%, you should see multiple alerts in the Alerts tab. At least one should have a red (High) flag, indicating a serious vulnerability like SQL Injection.

Not seeing any alerts?

Make sure DVWA is still running. Open http://localhost in your browser. If the page does not load, return to your Command Prompt and run docker start dvwa to restart the container.
Check that you entered http://localhost (not https://) in the URL to attack field. DVWA runs on plain HTTP.
If the scan started but shows zero progress, wait a moment. The spider needs time to discover pages before alerts appear.

Help me troubleshoot why my ZAP automated scan is not finding any alerts when scanning DVWA on localhost.

Your scan is complete and you have real vulnerability data to work with. Next, you will dig into individual alerts to understand exactly what each vulnerability means and how an attacker could exploit it.

Understand the Scan Results

Your scan is complete and ZAP has populated the Alerts tab with real vulnerabilities it discovered in DVWA.

A scan without interpretation is just noise. In this step, you will read the alerts ZAP produced, understand what each risk level means, and learn how a security professional would triage these findings.

In this step, get ready to:

Examine a High-risk alert in detail, including its description, evidence, and recommended fix.
Explore Medium and Low risk alerts to see the range of issues a scanner detects.
Understand ZAP's four risk rating levels and what each one means for an application.

Examine a High-risk alert

High-risk alerts are the most dangerous findings. They represent vulnerabilities that an attacker could exploit to steal data or take control of the application.

In the Alerts tab on the left side of ZAP, find the High-risk alerts (marked with a red flag).
Expand the High-risk section by clicking the arrow next to it.
Click on SQL Injection (if found in your results).
In the right panel, read through the four key sections: Description (what the vulnerability is), URL (where it was found), Attack (the string ZAP used to confirm it), and Solution (how to fix it).

What is SQL Injection?

SQL Injection is a vulnerability where an attacker inserts database commands into input fields (like a search box or login form). If the application does not sanitize the input, the attacker's commands run directly against the database.

The Attack string ZAP shows is the exact payload it sent to prove the vulnerability exists. This is what a real security report looks like.

Explore Medium and Low risk alerts

Not every vulnerability is critical. Medium and Low alerts represent issues that still need attention but pose less immediate danger.

In the Alerts tab, expand the Medium-risk section (orange flag).
Click on any Medium alert to see its details in the right panel.
For each alert, note three things: the risk level, the confidence level, and the URL affected.
Expand the Low-risk section (yellow flag) and click on an alert there as well.

What are common findings on DVWA?

Cross-Site Scripting (XSS) allows an attacker to inject malicious scripts into web pages viewed by other users. This is typically flagged as Medium risk.

Absence of security headers (like CSP and X-Frame-Options) means the application is missing protective settings that modern browsers expect. Cookie security issues indicate that session cookies could be intercepted or misused.

Understand ZAP's risk ratings

Every alert OWASP ZAP produces is categorized into one of four risk levels. Understanding these helps you prioritize which issues to fix first.

Review alerts across all four risk levels in the Alerts tab to see how ZAP categorizes each finding.
Notice the color coding: red (High), orange (Medium), yellow (Low), and blue (Informational).

What do the four risk levels mean?

High means an attacker could steal data or take control of the system. Fix these immediately.
Medium means a vulnerability that could be exploited with some effort. These still pose a real threat.
Low means a minor issue or information disclosure. Less urgent but still worth addressing.
Informational means a finding that is not directly exploitable but worth noting for best practices.

Triage like a security pro

In a real security assessment, you would start by fixing all High-risk issues, then move to Medium, then Low. Informational findings help harden the application but rarely block a release.

You can now read and interpret real vulnerability findings like a security analyst. Next up, you will turn these findings into a professional HTML report you can share with stakeholders.

Generate the Security Report

You have a full set of vulnerability alerts sitting in ZAP. Alerts are useful for analysis, but they live inside ZAP's interface.

To share your findings with a team or keep a record of what you discovered, you need to export them as a standalone report. ZAP's built-in Report Generation feature creates a professional HTML document you can open in any browser.

In this step, get ready to:

Select a professional report template and theme in ZAP.
Configure the report scope and title.
Generate and explore the HTML security report.

Select the report template

ZAP comes with multiple report templates for different formats and audiences. You will use the Modern HTML Report, which produces a clean, themed document with interactive sections.

In ZAP's top menu bar, click Report.
Click Generate Report... from the dropdown menu.
In the Generate Report dialog, click the Template tab.
From the template dropdown, select Modern HTML Report with themes and options.
In the Themes section below the dropdown, select Corporate [Light / Blue].

Why this template and theme?

The Modern HTML Report includes interactive charts, detailed alert breakdowns, and scan statistics in a single file. The Corporate theme gives it a professional blue colour scheme suitable for sharing with stakeholders or adding to a portfolio.

Configure scope and generate the report

The Scope tab controls what goes into the report. You will give it a descriptive title and confirm that it targets the DVWA site you scanned.

Click the Scope tab in the Generate Report dialog.
In the Report Title field, enter DVWA Vulnerability Assessment.
Confirm that http://localhost appears in the Sites list. It should already be selected from your scan.
Check the Display Report checkbox. This tells ZAP to open the finished report in your browser automatically.
Click Generate.

ZAP generates the report and opens it in your default browser.

Report not opening in your browser?

Make sure the Display Report checkbox was checked before you clicked Generate. If you missed it, you can find the generated file in ZAP's default reports directory (listed in the Report Directory field on the Scope tab). Open that folder and double-click the HTML file to view it.

help me find my generated ZAP report file

Explore the generated report

Your browser now shows a complete vulnerability assessment report. Take a few minutes to understand its structure.

Scroll to the Chart section at the top. This shows a visual summary of all findings grouped by risk level.
Scroll down to Alert Details. This lists every vulnerability found, with its description, the URL where it was detected, the attack string used, and remediation advice.
Continue to the Statistics section near the bottom. This shows overall scan coverage and request counts.

What do the report sections tell you?

The Chart section gives a quick at-a-glance risk breakdown. A manager or client can immediately see how many High, Medium, and Low issues exist.

The Alert Details section is where a developer goes to fix things. Each entry explains the vulnerability, shows proof it exists, and recommends a solution.

The Statistics section proves the scan was thorough by showing how many pages were tested and how many requests ZAP sent.

Save a copy of this report for your records. In your browser, press Ctrl+S to save the HTML file to a location you can find later (such as your Desktop).

Reports are self-contained

The HTML report file includes all styles and data inline. You can email it, upload it, or open it on any computer without needing ZAP installed.

Secret mission

Run an Authenticated Scan

Your first scan only found vulnerabilities on publicly accessible pages. Real web applications hide most of their functionality behind a login. Can you configure ZAP to scan as an authenticated user and uncover the vulnerabilities lurking behind DVWA's login page?

Clean Up Your Resources

This project runs entirely locally, so there are no ongoing costs. Decide whether to keep your resources running, pause them to come back later, or delete them entirely.

Resources you used:

Docker container dvwa running on port 80 (image: vulnerables/web-dvwa).
ZAP session data (stored locally while ZAP is open).

Keep everything running

No action needed. Choose this if you're still actively exploring DVWA or want to practice more scanning techniques.

Your Docker container continues running on port 80. You can access DVWA at http://localhost anytime.
ZAP remains open with your scan history and alerts intact for further review.
There is no cost. Everything runs locally on your machine.

Pause - I'll come back to this later

Shut down the running container to free up system resources. Your container data is preserved so you can restart it later.

Stop the DVWA container by running this in Command Prompt:

docker stop dvwa

Close ZAP when you are done reviewing your alerts.
When you want to resume, restart the container by running:

docker start dvwa

DVWA will be available again at http://localhost after restarting.

Delete - I don't want to use this again

Remove all project resources and start fresh. This frees up disk space by removing both the container and the downloaded image.

Remove the DVWA container by running this in Command Prompt:

docker rm -f dvwa

Remove the downloaded Docker image to reclaim disk space:

docker rmi vulnerables/web-dvwa

Close ZAP. Since you selected not to persist your session on first launch, closing ZAP clears all session data automatically.
To uninstall OWASP ZAP, open Windows Settings, select Apps, then Apps & features. Find Zed Attack Proxy in the list, click it, and select Uninstall.
To uninstall Oracle JDK 21, follow the same path in Apps & features. Find Java(TM) SE Development Kit 21 in the list and select Uninstall.
Delete your saved HTML report files from wherever you stored them on your computer.

Nice Work!

You just performed a professional vulnerability assessment on a live web application using industry-standard security tools. You now have hands-on experience with the same scanning workflow that security teams use to protect real applications.

Here's what you learned:

Launched a deliberately vulnerable web application (DVWA) in Docker and ran an automated spider and active scan with OWASP ZAP to discover real security vulnerabilities.
Interpreted vulnerability alerts including SQL Injection, XSS, and security misconfigurations, understanding risk levels and remediation advice.
Generated a professional HTML security report suitable for stakeholder communication, complete with charts, alert details, and scan statistics.
Secret Mission: Performed an authenticated scan to discover additional vulnerabilities hidden behind login pages, demonstrating why authenticated testing is critical for thorough security assessments.

Ready to quiz yourself?