Simon Bennetts

ZAP Updates - July 2025 Authentication improvements, Edge support, timing rule changes, Docker news, and a new scan rule.

ZAP Updates - July 2025
Authentication improvements, Edge support, timing rule changes, Docker news, and a new scan rule.
www.zaproxy.org/blog/2025-08...
#zaproxy #appsec

Yesterday there were more than 25K ZAP scans run using old versions of ZAP. These are no longer being maintained.
Update your ZAP installs now!
#zaproxy #appsec

We will be deleting all of the ZAP Docker images from the Software Security Project Docker Hub within the next 2 weeks. If you are still pulling images from there then please switch to one of the maintained options: www.zaproxy.org/download/#do...

The New 'ZAP is Out of Date' Rule If you are using an old version of ZAP then you might start seeing a new alert…

There is a new "ZAP is Out of Date" scan rule - learn more about it via this blog post
www.zaproxy.org/blog/2025-07...
#zaproxy #appsec

Timing Related Scan Rule Changes Scan rules related to time based attacks have been split or renamed.

We've recently made some requested changes to the naming and implementation of scan rules which used Time Based attacks. @kingthorin.bsky.social has written about it here: www.zaproxy.org/blog/2025-07...
#zaproxy #appsec

UK jobs market weakens as unemployment rate rises The official data shows wage growth has slowed while the number of vacancies continues to fall.

Here's an idea.

Corporation tax currently taxes profits.

Instead tax profits divided by the total wage bill of all those who's pay is below the median pay for the company.

www.bbc.co.uk/news/article...

None of the major browsers are currently flagging the latest ZAP downloads as suspicious🎉
Thank you to whoever sorted that out!

Edge Support ZAP now has “tier 1” support for Microsoft Edge, including exploring, crawling, and attacking.

ZAP now has full support for Microsoft Edge 😀
www.zaproxy.org/blog/2025-07...
#zaproxy #appsec

Authentication Improvements We’ve made a lot of improvements in ZAP’s handling of authentication - here’s a summary of the most significant changes we’ve made.

As promised, here is the first set of documentation for all of the authentication improvements the team has been working on
www.zaproxy.org/blog/2025-07...
#zaproxy #appsec

ZAP Updates - June 2025 A new Intro video, lots of authentication work, and more news on the ZAP browser extensions.

ZAP updates for June:
A new Intro video, lots of authentication work, and more news on the ZAP browser extensions.
www.zaproxy.org/blog/2025-07...
#zaproxy #appsec

All of the main browsers flag ZAP as dangerous/potential malware, and there doesnt see to be anything we can do about it.
We've updated the Download page www.zaproxy.org/download/

YouTube video by ZAP An Introduction to ZAP by Checkmarx - Official Version

Still unsure of what ZAP does?
See this video..
youtu.be/yywD8ebNn6o
#zaproxy #dast #appsec

GitHub - psiinon/owasp-top-10-top-10s Contribute to psiinon/owasp-top-10-top-10s development by creating an account on GitHub.

Introducing the Top 10 @owasp.org Top 10s!
github.com/psiinon/owas...

Mega add-on update alert!
We've just upload loads of add-ons, so update your ZAP instances ASAP.
Lots of authentication improvements have been included, more details coming soon ...

We have started to document how to configure ZAP against well known vulnerable apps: www.zaproxy.org/docs/testapps/ Let @psiinon.bsky.social know if you have any feedback or specific requests

Chrome 137 removed the "--load-extension" option. (Major situation!) · Issue #3771 · seleniumbase/SeleniumBase Chrome 137 removed the --load-extension option. (Major situation!) Specifically, Chrome-branded Chromium removed the --load-extension option in Chrome 137. (This doesn't affect Chrome-for-Testing, ...

Looks like its this github.com/seleniumbase...

The latest version of Chrome no longer loads extension added via @seleniumhq.bsky.social 😒
Has anyone else seen this, or have a workaround?

www.zaproxy.org/docs/getting...
#zaproxy #appsec

ZAP Updates - April 2025 April 2025 updates and ongoing feature development statuses.

Heres what the ZAP team have been working on during April www.zaproxy.org/blog/2025-05...

Release v17.3.0 · juice-shop/juice-shop · GitHub 🅰️ Frontend Updated frontend to Angular 19.x and Angular Material 19.x 🎨 User Interface #2541: Language selection dropdown is now searchable to make finding your preferred language even faster! ...

We just released v17.3.0! It brings Juice Shop to #Angular 19, fixes the non-default theme colors, and adds a convenient search filter to the language selection! Full release notes: github.com/juice-shop/j...

GitHub - al-sultani/prokzee: A cross-platform desktop application for HTTP/HTTPS traffic interception and analysis, built with Go. Features modern UI, traffic manipulation tools, request resending, fu... A cross-platform desktop application for HTTP/HTTPS traffic interception and analysis, built with Go. Features modern UI, traffic manipulation tools, request resending, fuzzing capabilities, and AI...

I've just added github.com/al-sultani/p... to github.com/psiinon/open...

ZAP Wins Inaugural DefectDojo Award for Open-Source Cybersecurity ZAP was recognised as being one of the best dynamic application security testing (DAST) Tools.

ZAP just won an award! Thanks DefectDojo!
www.zaproxy.org/blog/2025-04...
#zaproxy #appsec #award

113 years ago tonight, the Titanic struck an iceberg, as a result of hubris, greed and denial. It wouldn’t happen now, of course, as all the icebergs seem to be melting. For the same reasons.

Now that the performance of #owasp #wrongsecrets is restored (200rps on a Heroku free Dyno) feel free to use #zap against it ;-).

I have created a free, downloadable, secure coding guideline (22 pages), from my new book, Alice and Bob Learn Secure Coding. You can download it, and sign up for my newsletter, at the link below. Feel free to adopt it at work!
newsletter.shehacksp...

Big thanks to
@psiinon.bsky.social @kingthorin.bsky.social and all
@zaproxy.org contribs for your work on #ZAP #zaproxy. Amazing #infosec #Pentesting tool. Huge thanks to @checkmarxzero.bsky.social & @crashappsec.bsky.social for supporting this important project. #WebAppSec #AppSec

PortSwigger Labs: Broken Brute-Force Protection, IP Block Walkthrough for the PortSwigger lab, “Broken brute-force protection, IP block”.

New ZAP blog post c/o Jemimah O www.zaproxy.org/blog/2025-04...
#zaproxy #appsec

Brexit was the UK shooting itself in the foot.

We're about to see what happens after the USA has just shot itself in both feet.

📯YOUR INPUT IS NEEDED!📯

@OWASP ASVS version 5.0 release candidate is ready for review.

The final version is planned for the end of May. We want your feedback before then!

Can devs understand it? How about testers? Anything missing?

Dive into GitHub and let us know!

1/2

ZAP Updates - March 2025 We released 2.16.1 and made more authentication handling improvements.

The monthly ZAP Update Blog Post: www.zaproxy.org/blog/2025-04...
#zaproxy #appsec