ZAP Security Scan (Pro) — OWASP Passiv-Scan — AISeen Docs
Pro FeatureWie AISeen den OWASP ZAP Passiv-Scan ausführt: echter HTTP-Traffic, 150+ Regeln, Cookies, CORS, Header-Verstöße.
Available on Pro & Agency plans
ZAP scan requires running an OWASP ZAP Docker container as a proxy for the browser session. This provides deeper analysis than our free header scan but requires dedicated infrastructure — available on paid plans.
View Pro plansHow the ZAP scan works
- 01
Browser session starts
A headless Chromium browser navigates to your URL with OWASP ZAP running as an HTTP proxy.
- 02
Passive traffic analysis
ZAP intercepts all HTTP requests and responses without modifying them (passive mode — zero risk of breaking your site).
- 03
150+ rules applied
Each request/response pair is evaluated against OWASP's passive scanner rules — checking headers, cookies, content, and patterns.
- 04
Alerts generated
Findings are categorized by risk level: High, Medium, Low, and Informational.
- 05
Report delivered
You receive a structured report with each alert, its description, evidence, and recommended fix.
What ZAP finds
Missing Security Headers
Real browser-level check for all OWASP required headers.
Cookie Issues
Flags each cookie missing Secure, HttpOnly, or SameSite flags.
Mixed Content
HTTP resources (images, scripts, fonts) loaded on HTTPS pages.
CORS Issues
Overly permissive CORS headers detected in real responses.
Information Leakage
Server version strings, error messages, debug information.
Cache Control
Sensitive pages lacking Cache-Control: no-store, no-cache.
Content Type Issues
Responses without proper Content-Type or charset declaration.
CSP Weaknesses
Overly permissive CSP policies (unsafe-inline, unsafe-eval, *).
Authentication Headers
Missing or weak WWW-Authenticate and related auth signals.
Private IP Disclosure
Internal IP addresses or RFC 1918 addresses leaked in headers.
Alert risk levels
Direct attack vectors that can lead to data theft, account takeover, or full site compromise.
Examples:
- Missing HSTS on HTTPS site
- CSP not present
- Cookies without Secure flag on login form
Issues that require specific conditions to exploit but represent meaningful security gaps.
Examples:
- X-Content-Type-Options missing
- Referrer-Policy absent
- Anti-clickjacking header not set
Low-priority issues that contribute to defense-in-depth but are rarely exploited directly.
Examples:
- Cache-Control not set on sensitive page
- Timestamp disclosure
- X-XSS-Protection absent
Not vulnerabilities, but findings worth reviewing for completeness and best practice compliance.
Examples:
- Server header present (without version)
- Session cookie without HttpOnly
- Modern browser compatibility
ZAP scan vs. basic security check
ZAP Security Scan (Pro) — OWASP Passiv-Scan — AISeen Docs
Wie AISeen den OWASP ZAP Passiv-Scan ausführt: echter HTTP-Traffic, 150+ Regeln, Cookies, CORS, Header-Verstöße.