2018-07-09T07:46:00Z

What needs improvement with OWASP Zap?


Please share with the community what you think needs improvement with OWASP Zap.

What are its weaknesses? What would you like to see changed in a future version?

Guest
88 Answers

author avatar
Top 10Real User

The product is somewhat complicated and could be improved by simplifying it because you don't want to have to allocate one person to maintain the solution full time. We'd like to be able to deploy it and have it work. Ideally we'd like to be able to get a pull request analysis and the analysis of repositories. I think they could definitely work on a more simplified deployment. That would improve the product. The issues are not necessarily related to the solution but possibly connected to how it was initially set up.

2020-05-05T06:08:30Z
author avatar
Top 20Real User

The automatic scans need improvement. The automated vulnerability assessments that the application performs needs to be simplified as well as diversified.

2019-06-24T12:13:00Z
author avatar
Real User

I'm still in the process of exploring. I'd like to see a kind of feature where we can just track what our last vulnerability was and how it has improved or not. More reports that can have some kind of base-lining, I think that would be a good feature too. I'm not sure whether it can be achieved and implement but I think that would really help.

2019-06-24T12:13:00Z
author avatar
Vendor

There is definitely room for improvement. I prefer Burp Suite to OWASP Zap because of the extensive coverage it offers. I also think it should have an open-source tool. I would also love to see an improvement in visibility.

2019-06-23T09:40:00Z
author avatar
Top 5LeaderboardReal User

OWASP Zap has the award for best token authentication. A lot of applications are getting into this space where there are token barriers. Moreover ZAP Proxy security scans are excellent providing a comprehensive coverage. One area where the tool can be improved is specifically, if there's some more intelligence that can be added on to the reporting feature, it would be great. There's some element of intelligence that can be built into it as to how reports can be generated. Currently, there are only a few ways, i.e. a couple of templates with which you can generate these reports. If there are additional templates that could be put in place, the reports would come out very well, and we'd be able to edit it along reading the report. That could be good for us to make it through. Because that is an area that we've seen typically, where it's common in the other tools. We run the test. We run the scans. We do the vulnerability assessment, analyze their impacts and then we generate the report. There's the element of documentation that we need to create along with that. If there is a provision to enter inputs like below as part of report generation: * Project information * Client name * Organization name * Platform against which this test has been done If these small inputs can be handled, at the end of the report, I would have a customized report which I could easily give across to the customer. Today it's this is something not easily available in not at that level in the tool. In the reporting presentation format, Acunetix tool has a much better "look and feel" appearance. The clients love it when we do it in that.

2019-06-19T05:02:00Z
author avatar
Top 20Consultant

I would like for them to make it easier to understand exactly what has been checked and what has not been checked. We have to trust that it has checked all known vulnerabilities on all parts of the webapp, but it's a bit hard to see that after scanning. I would also like for them to develop graphical reports on the scan. Based on the log, some graphical drawing could show what part of the site has been tested. I would like to see that it has tested everything that we wanted to test.

2019-02-05T07:16:00Z
author avatar
Top 20Real User

It needs more robust reporting tools that can be in an editable form.

2018-09-09T05:40:00Z
author avatar
Real User

As security evolves, we would like DevOps built into it. As of now, Zap does not provide this. I would like to have more vulnerabilities added to the scan list, because as of now, it covers around 72 to 80. I need more because we need broader coverage.

2018-07-09T07:46:00Z
Find out what your peers are saying about OWASP , PortSwigger, Acunetix and others in Application Security Testing (AST). Updated: September 2020.
437,168 professionals have used our research since 2012.