# OWASP ZAP

### Fire Up Kali

Let's begin in the usual way—by firing up [Kali](https://null-byte.wonderhowto.com/how-to/hack-like-pro-getting-started-with-kali-your-new-hacking-system-0151631/). In this tutorial, I will be using Kali 2.0 as so many of you are now using it, although I still have my reservations. Earlier versions of Kali also have OWASP ZAP, so if you are using those, you can also follow this tutorial.

### Start OWASP ZAP

If you want to start OWASP ZAP from the command line, you can simply type:

**kali > owasp-zap**

![](https://990422818-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LWGXF4oLcghA1GLq0CM%2F-LbXC810mdTJ9uK-EPVJ%2F-LbXCSly8GJ9SV_iFJNi%2Fimage.png?alt=media\&token=e00f0294-3cdb-465b-9073-9a62d9f3b0af)

The first thing you will see is the license. Go ahead and accept the terms if you feel comfortable with them. This is a standard Apache license

If you don't have the zap installed in kali, Download it&#x20;

Zed Attack Proxy - <https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project>

**The OWASP ZAP Interface**

When OWASP ZAP eventually opens, it should look like the screenshot below. This tool has many powerful features, but initially, we will only try out its "Attack" function in the large right-hand window. In this mode, OWASP ZAP aggressively goes to the website we designate and begins to look for vulnerabilities

![](https://990422818-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LWGXF4oLcghA1GLq0CM%2F-LynmXlxTMILEXSwtaB3%2F-LynozQCyc6KgakSRSSH%2Fimage.png?alt=media\&token=d833c80d-0547-45f4-8fe4-0447eac6f03f)

![](https://990422818-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LWGXF4oLcghA1GLq0CM%2F-LbXC810mdTJ9uK-EPVJ%2F-LbXCYI-1oovCaQtvCGs%2Fimage.png?alt=media\&token=5add76d2-a0c2-4d68-9854-4a3c888d07d0)
