OWASP Zed Attack Proxy is a free and collaborative security tool. It is is devoted to the detection of vulnerabilities in web applications, for both beginners and professionals of application security
ZAP is an open-source software that includes many tools used to perform a wide range of penetration tests on a target web application. It is highly tunable, and thus allowing it to be applied on a large variety of applications. The basic startup tool also makes it easy to use for beginners.
It can be used as a basic scanner, or may be set up as a proxy between a navigator and the application backend.
It will eventually generate a list of vulnerabilities, classified according to OWASP Risk Rating Methodology
ZAP is developed and supported by a large community through its github.