OWASP ZAP is used to scan vulnerability on web application but its site says " Because this is a simulation that acts like a real attack, actual damage can be done to a site’s functionality, data, etc."

So why would someone use it to scan web app when it could damage it?

  • If Zap could damage your app when you run it. then imagine what will happen when someone else runs Zap on your app ... The warning is a "head's up".
    – schroeder
    Jul 11 at 21:17

1 Answer 1


Typically, if you're trying to scan your own (or your employer's) web app for vulnerabilities, you do it on a development or test instance that doesn't use production data, so if you discover a problem, you haven't damaged anything valuable. For example, you could run the scanner as part of a CI job, or security professionals could run it against a development instance on their own machine.

Some people do indeed run vulnerability scanners against production systems and then, frequently, report them as part of bug bounties. This is unhelpful because usually organizations offering bug bounties already do this and it takes some knowledge to determine whether something is actually a vulnerability (e.g., an out-of-date version number doesn't intrinsically mean a vulnerable version). It could also cause actual problems, such as an availability incident, which would not be received favourably. However, those people are often not conscient of the problem or don't care if they think they can make a few bucks.

There are other people who run scanners on production systems because they do want to cause havoc and will intentionally use whatever they learn to cause problems or extort the owners of the web app.

As usual, this is a situation where there are people who are careful and conscientious, people who are well-intentioned but possibly reckless, and people who are out to do harm. The warning is there to help people in the first and second categories make good decisions.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .