{"id":2951,"date":"2026-07-26T06:36:35","date_gmt":"2026-07-26T06:36:35","guid":{"rendered":"https:\/\/devsecopsschool.com\/blog\/?p=2951"},"modified":"2026-07-26T06:36:37","modified_gmt":"2026-07-26T06:36:37","slug":"how-to-install-and-configure-owasp-zap-proxy-on-macos-complete-beginners-guide","status":"publish","type":"post","link":"https:\/\/devsecopsschool.com\/blog\/how-to-install-and-configure-owasp-zap-proxy-on-macos-complete-beginners-guide\/","title":{"rendered":"How to Install and Configure OWASP ZAP Proxy on macOS: Complete Beginner\u2019s Guide"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>SEO title:<\/strong> How to Install and Configure OWASP ZAP Proxy on macOS<br><strong>Meta description:<\/strong> Learn how to install OWASP ZAP on an Intel or Apple Silicon Mac, configure its proxy, install the ZAP root certificate, connect Chrome, Safari, or Firefox, and verify intercepted traffic.<br><strong>Suggested URL:<\/strong> <code>\/install-configure-owasp-zap-proxy-macos<\/code><br><strong>Updated:<\/strong> July 2026<br><strong>Tested with:<\/strong> ZAP 2.17.0<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Introduction<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP, commonly known as <strong>OWASP ZAP<\/strong> or <strong>Zed Attack Proxy<\/strong>, is a free and open-source web application security testing tool.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP sits between your browser and a web application:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Browser\n   |\n   | HTTP or HTTPS request\n   v\nOWASP ZAP Proxy\n   |\n   | Request forwarded to application\n   v\nWeb Application\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This position allows ZAP to:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Capture browser requests and server responses<\/li>\n\n\n\n<li>Passively inspect web traffic<\/li>\n\n\n\n<li>Modify requests<\/li>\n\n\n\n<li>Crawl web applications<\/li>\n\n\n\n<li>Test authentication and sessions<\/li>\n\n\n\n<li>Identify common web vulnerabilities<\/li>\n\n\n\n<li>Perform active security scans<\/li>\n\n\n\n<li>Generate security reports<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This guide explains how to install and configure ZAP on macOS so that someone using it for the first time can follow every step.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Important Legal and Safety Warning<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Only use ZAP against:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Applications you own<\/li>\n\n\n\n<li>Applications running in your local lab<\/li>\n\n\n\n<li>Training applications<\/li>\n\n\n\n<li>Systems for which you have written authorization<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">An active ZAP scan sends attack payloads to the target. It can alter data, create records, trigger business operations, overload services or damage an application.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP\u2019s documentation distinguishes passive scanning\u2014which observes proxied traffic\u2014from active scanning, which sends real attack payloads. Active scanning must only be performed against authorized targets.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For this installation guide, begin in <strong>Safe Mode<\/strong> and use only passive browsing until you understand the tool.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">What You Will Accomplish<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">By the end of this guide, you will be able to:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Identify whether your Mac uses Apple Silicon or Intel.<\/li>\n\n\n\n<li>Download the correct ZAP installer.<\/li>\n\n\n\n<li>Verify the downloaded installer.<\/li>\n\n\n\n<li>Install and start ZAP.<\/li>\n\n\n\n<li>configure its local proxy.<\/li>\n\n\n\n<li>Launch a browser through ZAP.<\/li>\n\n\n\n<li>Configure an existing browser manually.<\/li>\n\n\n\n<li>install and trust the ZAP root certificate.<\/li>\n\n\n\n<li>Verify that HTTP and HTTPS traffic reaches ZAP.<\/li>\n\n\n\n<li>Troubleshoot common macOS issues.<\/li>\n\n\n\n<li>safely remove the proxy and certificate when finished.<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Prerequisites<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">You need:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A Mac running a maintained version of macOS<\/li>\n\n\n\n<li>An administrator account<\/li>\n\n\n\n<li>An internet connection<\/li>\n\n\n\n<li>Approximately 1 GB of free disk space<\/li>\n\n\n\n<li>Chrome or Firefox for the easiest browser-based testing<\/li>\n\n\n\n<li>Permission to test your target application<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The current macOS ZAP package includes Java 17, so you do not need to install Java separately when using the official macOS installer. The current stable release is ZAP 2.17.0, and separate installers are available for Intel and Apple Silicon Macs.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 1: Determine Your Mac Processor<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Before downloading ZAP, determine whether your Mac uses an Apple Silicon or Intel processor.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Open Terminal<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Press <code>Command + Space<\/code>.<\/li>\n\n\n\n<li>Type:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>Terminal\n<\/code><\/pre>\n\n\n\n<ol start=\"3\" class=\"wp-block-list\">\n<li>Press <code>Return<\/code>.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Check the processor architecture<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Run:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>uname -m\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You will see one of the following results.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Result<\/th><th>Mac type<\/th><th>Installer required<\/th><\/tr><\/thead><tbody><tr><td><code>arm64<\/code><\/td><td>Apple Silicon, such as M1, M2, M3, M4 or newer<\/td><td>Apple Silicon\/aarch64<\/td><\/tr><tr><td><code>x86_64<\/code><\/td><td>Intel Mac<\/td><td>Intel\/amd64<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">You can also check through the graphical interface:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open the Apple menu.<\/li>\n\n\n\n<li>Select <strong>About This Mac<\/strong>.<\/li>\n\n\n\n<li>Look for either <strong>Chip<\/strong> or <strong>Processor<\/strong>.<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 2: Choose an Installation Method<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">There are two common ways to install ZAP on macOS:<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Method A: Official macOS installer<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This is the recommended approach for beginners.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Advantages:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Official ZAP package<\/li>\n\n\n\n<li>Separate Apple Silicon and Intel builds<\/li>\n\n\n\n<li>Java is included<\/li>\n\n\n\n<li>No package manager is required<\/li>\n\n\n\n<li>Easy to troubleshoot<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Method B: Homebrew<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Homebrew currently supports:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>brew install --cask zap\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">However, the Homebrew cask is marked as deprecated and scheduled to be disabled on September 1, 2026. Therefore, the official macOS installer is the safer long-term choice for this guide.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 3: Install ZAP Using the Official Installer<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Download ZAP<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Open the official ZAP download page in your browser.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Select the installer matching your Mac:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">For Apple Silicon<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Download:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ZAP_2.17.0_aarch64.dmg\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">For Intel Mac<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Download:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ZAP_2.17.0.dmg\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The official release page lists both macOS packages and publishes SHA-256 checksums for verifying them.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Do not download ZAP from unknown software-download websites.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Find the downloaded file<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">By default, the file should be in:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Finder \u2192 Downloads\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You can also check from Terminal:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ls -lh ~\/Downloads\/ZAP*.dmg\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You should see the downloaded DMG file.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Verify the installer checksum<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Checksum verification confirms that your downloaded file matches the file published by the ZAP project.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Open Terminal and move to the Downloads directory:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cd ~\/Downloads\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Verify the Apple Silicon package<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>shasum -a 256 ZAP_2.17.0_aarch64.dmg\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The expected SHA-256 value for ZAP 2.17.0 is:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>3b3c6c8b105a33cb2a7d718e7f9aa41418a6d8aae3887d94a42523b5eeac723b\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Verify the Intel package<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>shasum -a 256 ZAP_2.17.0.dmg\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The expected SHA-256 value is:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>a3d246125dd6e576036af8fb29f90377fc72a0a5df8c89c54711972b449582c7\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">These values are published on the official ZAP 2.17.0 release page.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What should you check?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The value printed by Terminal must exactly match the official value.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If it does not match:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Delete the downloaded file.<\/li>\n\n\n\n<li>Download it again from the official source.<\/li>\n\n\n\n<li>Repeat the checksum verification.<\/li>\n\n\n\n<li>Do not install a file whose checksum is incorrect.<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4: Open the DMG<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open <strong>Finder<\/strong>.<\/li>\n\n\n\n<li>Open <strong>Downloads<\/strong>.<\/li>\n\n\n\n<li>Double-click the ZAP DMG file.<\/li>\n\n\n\n<li>Wait for macOS to mount the disk image.<\/li>\n\n\n\n<li>Double-click the ZAP installer or application shown in the window.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Follow the installer prompts:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Read the license agreement.<\/li>\n\n\n\n<li>Select <strong>Accept<\/strong> if you agree.<\/li>\n\n\n\n<li>Choose <strong>Standard Installation<\/strong>.<\/li>\n\n\n\n<li>Continue through the installation.<\/li>\n\n\n\n<li>Select <strong>Finish<\/strong> when installation completes.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">The Standard option is appropriate for most beginners. The Custom option is mainly useful when you need to change the installation location or included components.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 4: Handle the macOS Security Warning<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP releases may display a warning such as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u201cZAP.app\u201d cannot be opened because the developer cannot be verified.\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The official ZAP documentation currently warns that this may happen on macOS.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Do not disable macOS security globally.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Safe way to allow ZAP<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Attempt to open ZAP once.<\/li>\n\n\n\n<li>When the warning appears, select <strong>Cancel<\/strong>.<\/li>\n\n\n\n<li>Open the Apple menu.<\/li>\n\n\n\n<li>Select <strong>System Settings<\/strong>.<\/li>\n\n\n\n<li>Open <strong>Privacy &amp; Security<\/strong>.<\/li>\n\n\n\n<li>Scroll down to the <strong>Security<\/strong> section.<\/li>\n\n\n\n<li>Find the message saying ZAP was blocked.<\/li>\n\n\n\n<li>Select <strong>Open Anyway<\/strong>.<\/li>\n\n\n\n<li>Authenticate with Touch ID or your administrator password.<\/li>\n\n\n\n<li>Confirm by selecting <strong>Open<\/strong>.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Apple documents this controlled override for applications from an unknown or unverified developer.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Only approve the application after downloading it from the official source and verifying its checksum.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 5: Start ZAP for the First Time<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">You can launch ZAP from:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Finder \u2192 Applications \u2192 ZAP\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You can also press <code>Command + Space<\/code>, type:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ZAP\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">and press <code>Return<\/code>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">From Terminal, you may try:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>open -a ZAP\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Accept the terms<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">On the first launch:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Read the displayed license or terms.<\/li>\n\n\n\n<li>Select <strong>Agree<\/strong> if you accept them.<\/li>\n\n\n\n<li>Wait for the ZAP desktop interface to load.<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Choose whether to save the session<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP will ask whether you want to persist the session.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You will normally see options similar to:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Persist the session with a chosen name and location<\/li>\n\n\n\n<li>Persist the session using default settings<\/li>\n\n\n\n<li>Do not persist this session<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">For your first test, select:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>No, I do not want to persist this session at this moment in time\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Then select <strong>Start<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A non-persistent session is deleted when ZAP exits. Persisted sessions retain captured requests, responses, sites, alerts and related testing data.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Security note<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP sessions can contain:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>URLs<\/li>\n\n\n\n<li>Authentication cookies<\/li>\n\n\n\n<li>Request bodies<\/li>\n\n\n\n<li>API parameters<\/li>\n\n\n\n<li>Headers<\/li>\n\n\n\n<li>Personal information<\/li>\n\n\n\n<li>Application responses<\/li>\n\n\n\n<li>Tokens and session identifiers<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Store persistent sessions only in an approved and protected location.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 6: Understand the ZAP Interface<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">The main ZAP window contains several important areas.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Menu bar<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The menu bar includes options such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>File<\/li>\n\n\n\n<li>Edit<\/li>\n\n\n\n<li>View<\/li>\n\n\n\n<li>Analyse<\/li>\n\n\n\n<li>Report<\/li>\n\n\n\n<li>Tools<\/li>\n\n\n\n<li>Help<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Toolbar<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The toolbar provides quick access to:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Operating modes<\/li>\n\n\n\n<li>Breakpoints<\/li>\n\n\n\n<li>Add-ons<\/li>\n\n\n\n<li>Browser launching<\/li>\n\n\n\n<li>Scanning controls<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Sites tree<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The Sites tree appears on the left side.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It displays websites and endpoints observed through ZAP.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Sites\n\u2514\u2500\u2500 https:\/\/my-application.test\n    \u251c\u2500\u2500 login\n    \u251c\u2500\u2500 dashboard\n    \u251c\u2500\u2500 api\n    \u2514\u2500\u2500 logout\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Request and response area<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">When you select an entry, ZAP shows:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>HTTP request headers<\/li>\n\n\n\n<li>HTTP request body<\/li>\n\n\n\n<li>HTTP response headers<\/li>\n\n\n\n<li>HTTP response body<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Information tabs<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The lower area can show:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>History<\/li>\n\n\n\n<li>Alerts<\/li>\n\n\n\n<li>Spider results<\/li>\n\n\n\n<li>Active Scan progress<\/li>\n\n\n\n<li>Output<\/li>\n\n\n\n<li>WebSocket messages<\/li>\n\n\n\n<li>Search results<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The official ZAP guide describes these as the Tree Window, Workspace Window and Information Window.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 7: Put ZAP in Safe Mode<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Before connecting a browser, switch ZAP to Safe Mode.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Steps<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Look at the main ZAP toolbar.<\/li>\n\n\n\n<li>Find the mode selection dropdown.<\/li>\n\n\n\n<li>Open the dropdown.<\/li>\n\n\n\n<li>Select:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>Safe Mode\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Safe Mode restricts potentially dangerous operations.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is the best starting mode for:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Learning the interface<\/li>\n\n\n\n<li>Capturing browser traffic<\/li>\n\n\n\n<li>Inspecting requests<\/li>\n\n\n\n<li>Running passive analysis<\/li>\n\n\n\n<li>Confirming proxy configuration<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The official getting-started guide specifically recommends Safe Mode when you want to prevent ZAP from performing potentially harmful actions.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 8: Update the ZAP Add-ons<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP uses add-ons to provide scanners, spiders, browser integration, reporting and other features.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Steps<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Start ZAP.<\/li>\n\n\n\n<li>Find the <strong>Manage Add-ons<\/strong> button in the toolbar.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Alternatively, open the relevant option from the ZAP marketplace or tools menu.<\/p>\n\n\n\n<ol start=\"3\" class=\"wp-block-list\">\n<li>Open the <strong>Updates<\/strong> or <strong>Installed<\/strong> section.<\/li>\n\n\n\n<li>Install available updates.<\/li>\n\n\n\n<li>Restart ZAP if requested.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">The ZAP Marketplace provides free add-ons and can be accessed directly from the desktop toolbar.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For your first setup, ensure that commonly used components are installed, including:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Quick Start<\/li>\n\n\n\n<li>Network<\/li>\n\n\n\n<li>Passive scanner rules<\/li>\n\n\n\n<li>Browser integration<\/li>\n\n\n\n<li>Client Spider<\/li>\n\n\n\n<li>Report generation<\/li>\n\n\n\n<li>Selenium-related browser support, when required<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Do not install every available experimental add-on immediately. Start with the default stable components.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 9: Check the ZAP Proxy Address and Port<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">By default, ZAP listens on:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Address: localhost\nPort: 8080\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><code>localhost<\/code> means that only applications running on your Mac can connect to that listener.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Steps<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open ZAP.<\/li>\n\n\n\n<li>Select <strong>Tools<\/strong>.<\/li>\n\n\n\n<li>Select <strong>Options<\/strong>.<\/li>\n\n\n\n<li>Expand <strong>Network<\/strong>.<\/li>\n\n\n\n<li>Select <strong>Local Servers\/Proxies<\/strong>.<\/li>\n\n\n\n<li>Locate <strong>Main Proxy<\/strong>.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Confirm that it shows:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Address: localhost\nPort: 8080\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Depending on the displayed values, you may also see:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>127.0.0.1\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This is equivalent to the IPv4 loopback address for your local Mac.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP\u2019s main proxy is configured under <strong>Network \u2192 Local Servers\/Proxies<\/strong>, and the browser must use the same address and port.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Recommended beginner configuration<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Use:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Address: 127.0.0.1\nPort: 8080\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Do not use:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>0.0.0.0\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">for a basic local setup.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Binding ZAP to <code>0.0.0.0<\/code> may make it accessible through other network interfaces. That is unnecessary and potentially unsafe for a beginner workstation.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 10: Check Whether Port 8080 Is Available<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Open Terminal and run:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>lsof -nP -iTCP:8080 -sTCP:LISTEN\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">When ZAP is running, you should see a Java or ZAP-related process listening on port 8080.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If another application is already using port 8080, either stop that application or change ZAP to another port, such as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>8090\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">To change the port:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open <strong>Tools \u2192 Options<\/strong>.<\/li>\n\n\n\n<li>Open <strong>Network \u2192 Local Servers\/Proxies<\/strong>.<\/li>\n\n\n\n<li>Select the main proxy.<\/li>\n\n\n\n<li>Change the port from <code>8080<\/code> to <code>8090<\/code>.<\/li>\n\n\n\n<li>Save the settings.<\/li>\n\n\n\n<li>Configure the browser to use the same new port.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">The browser port and the ZAP port must always match.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 11: Recommended Browser Configuration for Beginners<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">There are two ways to send browser traffic through ZAP.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Option 1: Launch a browser directly from ZAP<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This is the recommended approach.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Option 2: Manually configure your normal browser<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This is useful when you need:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Your existing browser profile<\/li>\n\n\n\n<li>Installed browser extensions<\/li>\n\n\n\n<li>Stored development credentials<\/li>\n\n\n\n<li>A specific browser configuration<\/li>\n\n\n\n<li>Persistent testing sessions<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Start with Option 1.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 12: Launch a Preconfigured Browser from ZAP<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">A browser launched by ZAP is automatically configured to use the ZAP proxy.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP also creates a temporary browser profile, so your normal browser profile is not modified.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Steps<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Start ZAP.<\/li>\n\n\n\n<li>Open the <strong>Quick Start<\/strong> tab.<\/li>\n\n\n\n<li>Select <strong>Manual Explore<\/strong>.<\/li>\n\n\n\n<li>Enter a URL you are authorized to access.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">For a simple proxy verification, you may use:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>https:&#47;&#47;example.com\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Do not run an active scan against it. Use it only to verify normal browsing and passive traffic capture.<\/p>\n\n\n\n<ol start=\"5\" class=\"wp-block-list\">\n<li>Select Chrome or Firefox.<\/li>\n\n\n\n<li>Leave <strong>Enable HUD<\/strong> disabled for your first test.<\/li>\n\n\n\n<li>Select <strong>Launch Browser<\/strong>.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP will open a new browser window with a temporary profile.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Browsers launched through the Quick Start Manual Explore feature are preconfigured to use ZAP and ignore the certificate warnings that would otherwise occur during HTTPS interception.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Verify the captured traffic<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In the launched browser:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open the target website.<\/li>\n\n\n\n<li>Navigate through one or two pages.<\/li>\n\n\n\n<li>Return to ZAP.<\/li>\n\n\n\n<li>Look at the <strong>Sites<\/strong> tree.<\/li>\n\n\n\n<li>Open the <strong>History<\/strong> tab.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">You should see entries such as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>GET https:\/\/example.com\/\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Select an entry.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP should show:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The request method<\/li>\n\n\n\n<li>The requested URL<\/li>\n\n\n\n<li>Request headers<\/li>\n\n\n\n<li>Response status<\/li>\n\n\n\n<li>Response headers<\/li>\n\n\n\n<li>Response content<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Your ZAP proxy is now working.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 13: Understand Passive Scanning<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP automatically performs passive scanning on traffic that passes through the proxy.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Passive scanning examines requests and responses without sending additional attack requests.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It may detect issues such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Missing security headers<\/li>\n\n\n\n<li>Insecure cookies<\/li>\n\n\n\n<li>Information disclosure<\/li>\n\n\n\n<li>Cache-control weaknesses<\/li>\n\n\n\n<li>Content-type problems<\/li>\n\n\n\n<li>Cross-origin policy issues<\/li>\n\n\n\n<li>Suspicious response content<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The ZAP documentation states that passive scanning does not modify application responses and runs in the background while you explore the application.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To view the findings:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open the <strong>Alerts<\/strong> tab.<\/li>\n\n\n\n<li>Expand a risk category.<\/li>\n\n\n\n<li>Select an alert.<\/li>\n\n\n\n<li>Review:\n<ul class=\"wp-block-list\">\n<li>Risk<\/li>\n\n\n\n<li>Confidence<\/li>\n\n\n\n<li>Description<\/li>\n\n\n\n<li>Evidence<\/li>\n\n\n\n<li>URL<\/li>\n\n\n\n<li>Parameter<\/li>\n\n\n\n<li>Recommended solution<\/li>\n\n\n\n<li>Reference information<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">An alert is not automatically proof of a vulnerability. Review the evidence and confirm the result manually.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 14: Manually Configure Chrome or Safari on macOS<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Chrome and Safari can use the macOS system proxy.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This method changes the proxy for applications that follow the macOS network proxy configuration\u2014not just one browser.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Before proceeding<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Keep ZAP running. If you configure the system proxy and then close ZAP, applications may lose internet access until you disable the proxy again.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Steps<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open the Apple menu.<\/li>\n\n\n\n<li>Select <strong>System Settings<\/strong>.<\/li>\n\n\n\n<li>Select <strong>Network<\/strong>.<\/li>\n\n\n\n<li>Select your active connection:\n<ul class=\"wp-block-list\">\n<li>Wi-Fi, or<\/li>\n\n\n\n<li>Ethernet<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Select <strong>Details<\/strong>.<\/li>\n\n\n\n<li>Select <strong>Proxies<\/strong>.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Apple documents this path as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>System Settings \u2192 Network \u2192 Network service \u2192 Details \u2192 Proxies\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Configure the HTTP proxy<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Enable:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Web Proxy (HTTP)\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Enter:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Server: 127.0.0.1\nPort: 8080\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Do not enable proxy authentication.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Configure the HTTPS proxy<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Enable:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Secure Web Proxy (HTTPS)\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Enter:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Server: 127.0.0.1\nPort: 8080\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Again, do not enable proxy authentication.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Apple\u2019s proxy settings provide separate entries for HTTP and HTTPS proxy servers.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Save the configuration<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Select <strong>OK<\/strong> or <strong>Done<\/strong>.<\/li>\n\n\n\n<li>Close System Settings.<\/li>\n\n\n\n<li>Keep ZAP running.<\/li>\n\n\n\n<li>Open Chrome or Safari.<\/li>\n\n\n\n<li>Browse to a test URL.<\/li>\n\n\n\n<li>Confirm that the request appears in ZAP.<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 15: Configure Firefox Manually<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Firefox can either use the macOS system proxy or maintain its own proxy configuration.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Recommended Firefox configuration<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open Firefox.<\/li>\n\n\n\n<li>Open <strong>Settings<\/strong>.<\/li>\n\n\n\n<li>Select <strong>General<\/strong>.<\/li>\n\n\n\n<li>Scroll down to <strong>Network Settings<\/strong>.<\/li>\n\n\n\n<li>Select <strong>Settings<\/strong>.<\/li>\n\n\n\n<li>Select <strong>Manual proxy configuration<\/strong>.<\/li>\n\n\n\n<li>Enter:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>HTTP Proxy: 127.0.0.1\nPort: 8080\n<\/code><\/pre>\n\n\n\n<ol start=\"8\" class=\"wp-block-list\">\n<li>Enable the option to use the same proxy for HTTPS, when displayed.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Alternatively, select:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Use system proxy settings\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">when you have already configured the macOS proxy.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Mozilla documents both manual proxy configuration and use of the operating system\u2019s proxy settings.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 16: Why HTTPS Requires a ZAP Certificate<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Plain HTTP traffic is not encrypted.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">HTTPS traffic is encrypted between the browser and the web server.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To inspect HTTPS, ZAP creates two encrypted connections:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Browser\n   |\n   | HTTPS encrypted with a ZAP-generated certificate\n   v\nZAP\n   |\n   | HTTPS encrypted with the real server certificate\n   v\nWeb Server\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP dynamically generates a certificate for each HTTPS hostname and signs it using its own ZAP Root CA certificate.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Your browser does not trust this private certificate authority by default. Therefore, a manually configured browser may display certificate errors until you trust the ZAP Root CA.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP documents this as a manipulator-in-the-middle process in which its Root CA signs the certificates generated for intercepted HTTPS websites.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 17: Export the ZAP Root CA Certificate<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">You do not normally need this when using a browser launched directly from ZAP.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You need it when manually proxying an existing browser or another HTTP client.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Steps<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open ZAP.<\/li>\n\n\n\n<li>Select <strong>Tools<\/strong>.<\/li>\n\n\n\n<li>Select <strong>Options<\/strong>.<\/li>\n\n\n\n<li>Expand <strong>Network<\/strong>.<\/li>\n\n\n\n<li>Select <strong>Server Certificates<\/strong>.<\/li>\n\n\n\n<li>Locate the Root CA certificate section.<\/li>\n\n\n\n<li>Select <strong>Save<\/strong>.<\/li>\n\n\n\n<li>Save the certificate somewhere easy to find, such as:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>Downloads\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Use a recognizable filename:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>zap-root-ca.cer\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP generates a Root CA during the first run. When the browser-launch feature is not used, the certificate must be installed in the browser or client that sends HTTPS traffic through ZAP.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 18: Install the ZAP Certificate in macOS Keychain<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Open Keychain Access<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Press <code>Command + Space<\/code>.<\/li>\n\n\n\n<li>Type:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>Keychain Access\n<\/code><\/pre>\n\n\n\n<ol start=\"3\" class=\"wp-block-list\">\n<li>Press <code>Return<\/code>.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Choose a keychain<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In the left panel, select:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>login\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">for your current user.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For a system-wide installation, select:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>System\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">System-wide installation normally requires administrator privileges.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Import the certificate<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">You can import it in either of these ways:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Method A<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Drag <code>zap-root-ca.cer<\/code> from Finder into Keychain Access.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Method B<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Use the import option from the Keychain Access menu and choose the certificate file.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Apple confirms that certificates can be added by selecting the login or System keychain and dragging the certificate file into Keychain Access.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 19: Trust the ZAP Certificate<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Importing a certificate does not always mean it is trusted automatically.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Steps<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In Keychain Access, select <strong>Certificates<\/strong>.<\/li>\n\n\n\n<li>Search for:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>ZAP\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">or:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Zed Attack Proxy Root CA\n<\/code><\/pre>\n\n\n\n<ol start=\"3\" class=\"wp-block-list\">\n<li>Double-click the certificate.<\/li>\n\n\n\n<li>Expand the <strong>Trust<\/strong> section.<\/li>\n\n\n\n<li>Change:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>When using this certificate\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">to:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Always Trust\n<\/code><\/pre>\n\n\n\n<ol start=\"6\" class=\"wp-block-list\">\n<li>Close the certificate window.<\/li>\n\n\n\n<li>Enter your administrator password or use Touch ID.<\/li>\n\n\n\n<li>Restart the browser.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Apple\u2019s Keychain Access documentation explains that certificate trust is changed by opening the certificate, expanding <strong>Trust<\/strong> and selecting a new trust setting.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Certificate security warning<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Trusting the ZAP Root CA allows that ZAP installation to generate certificates your Mac considers trusted.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Export the certificate only from your own ZAP installation.<\/li>\n\n\n\n<li>Do not download a ZAP root certificate from another person.<\/li>\n\n\n\n<li>Do not share a certificate that includes its private key.<\/li>\n\n\n\n<li>Do not install an unknown interception certificate.<\/li>\n\n\n\n<li>Remove the certificate when it is no longer required.<\/li>\n\n\n\n<li>Do not perform personal banking or other sensitive browsing through the ZAP proxy.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">For daily work, a temporary browser launched by ZAP is usually safer and easier than changing the Mac-wide proxy and certificate configuration.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 20: Test HTTP Proxying from Terminal<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">You can test ZAP without a browser by using <code>curl<\/code>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Keep ZAP running and execute:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>curl -x http:\/\/127.0.0.1:8080 http:\/\/example.com -I\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Explanation:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>curl<\/code> sends an HTTP request.<\/li>\n\n\n\n<li><code>-x<\/code> specifies the proxy.<\/li>\n\n\n\n<li><code>127.0.0.1<\/code> is your Mac.<\/li>\n\n\n\n<li><code>8080<\/code> is the default ZAP proxy port.<\/li>\n\n\n\n<li><code>-I<\/code> requests response headers only.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Return to ZAP and open the <strong>History<\/strong> tab.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You should see the request.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you changed ZAP to port 8090, use:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>curl -x http:\/\/127.0.0.1:8090 http:\/\/example.com -I\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 21: Safely Test an Application<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">For an initial test:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Put ZAP in <strong>Safe Mode<\/strong>.<\/li>\n\n\n\n<li>Open <strong>Quick Start<\/strong>.<\/li>\n\n\n\n<li>Select <strong>Manual Explore<\/strong>.<\/li>\n\n\n\n<li>Enter the URL of an application you own or are authorized to test.<\/li>\n\n\n\n<li>Launch Chrome or Firefox from ZAP.<\/li>\n\n\n\n<li>Browse through the application normally.<\/li>\n\n\n\n<li>Log in with a dedicated testing account.<\/li>\n\n\n\n<li>Visit each authorized function.<\/li>\n\n\n\n<li>Return to ZAP.<\/li>\n\n\n\n<li>Review the Sites, History and Alerts tabs.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">During manual exploration, ZAP builds the site tree and passively scans all requests and responses passing through it. ZAP recommends combining browser-based manual exploration with automated crawling because manual navigation can reach authenticated forms and workflows that spiders may not understand.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Do not select <strong>Attack<\/strong> or start an active scan during this setup verification.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 22: When to Persist a ZAP Session<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Once the setup works, you may want to preserve your work.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Use a persistent session when:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Testing takes place over several days<\/li>\n\n\n\n<li>Findings must be reviewed later<\/li>\n\n\n\n<li>You need to preserve request history<\/li>\n\n\n\n<li>You need to preserve contexts or authentication settings<\/li>\n\n\n\n<li>You are preparing a report<\/li>\n\n\n\n<li>You need an auditable test record<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Do not persist a session when:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>You are only testing the installation<\/li>\n\n\n\n<li>The traffic contains highly sensitive production data<\/li>\n\n\n\n<li>Your organization prohibits storing session tokens<\/li>\n\n\n\n<li>You do not have an approved storage location<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">When saving a session, use a meaningful filename:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>customer-portal-staging-2026-07-26.session\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Never commit ZAP sessions to a public Git repository.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 23: Recommended Beginner Configuration<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Use the following baseline.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">ZAP listener<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>Address: 127.0.0.1\nPort: 8080\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">ZAP operating mode<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>Safe Mode\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Browser<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>Browser launched through Quick Start \u2192 Manual Explore\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Session<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>Do not persist for the first test\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Add-ons<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>Install stable updates\nAvoid experimental add-ons initially\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Scanning<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>Passive scanning only\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Target<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>Local, lab, staging or explicitly authorized application\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Certificate<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>Do not install system-wide unless an existing browser profile is required\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This configuration minimizes accidental scanning and avoids changing the Mac-wide proxy unnecessarily.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 24: Common Problems and Solutions<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">Problem 1: ZAP cannot be opened<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Symptom<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>\u201cZAP.app\u201d cannot be opened because the developer cannot be verified.\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Solution<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Verify that you downloaded ZAP from the official source.<\/li>\n\n\n\n<li>Verify its SHA-256 checksum.<\/li>\n\n\n\n<li>Attempt to open it once.<\/li>\n\n\n\n<li>Open <strong>System Settings \u2192 Privacy &amp; Security<\/strong>.<\/li>\n\n\n\n<li>Select <strong>Open Anyway<\/strong>.<\/li>\n\n\n\n<li>Authenticate and confirm.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Do not disable Gatekeeper globally.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Problem 2: Port 8080 is already in use<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Run:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>lsof -nP -iTCP:8080 -sTCP:LISTEN\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If another program is using the port:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Stop that program, or<\/li>\n\n\n\n<li>Change ZAP to port <code>8090<\/code>.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Then update the browser proxy to:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>127.0.0.1:8090\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Problem 3: Browser has no internet connection<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Possible causes:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>ZAP is not running.<\/li>\n\n\n\n<li>The browser is configured to use ZAP.<\/li>\n\n\n\n<li>The system proxy is still enabled.<\/li>\n\n\n\n<li>The browser proxy port does not match ZAP.<\/li>\n\n\n\n<li>A VPN or corporate proxy is interfering.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Solution<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Start ZAP.<\/li>\n\n\n\n<li>Confirm ZAP listens on the configured port.<\/li>\n\n\n\n<li>Check the browser proxy address.<\/li>\n\n\n\n<li>If finished testing, disable the macOS proxy.<\/li>\n\n\n\n<li>Restart the browser.<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Problem 4: HTTPS websites show certificate warnings<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Possible causes:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The ZAP Root CA was not installed.<\/li>\n\n\n\n<li>The certificate was imported but not trusted.<\/li>\n\n\n\n<li>The browser was not restarted.<\/li>\n\n\n\n<li>The certificate came from a different ZAP installation.<\/li>\n\n\n\n<li>The ZAP root certificate has expired or changed.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Simplest solution<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Use:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Quick Start \u2192 Manual Explore \u2192 Launch Browser\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The launched browser is configured by ZAP.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Existing-browser solution<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Export the current Root CA from ZAP.<\/li>\n\n\n\n<li>Import it into Keychain Access.<\/li>\n\n\n\n<li>Set it to <strong>Always Trust<\/strong>.<\/li>\n\n\n\n<li>Restart the browser.<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Problem 5: No requests appear in ZAP<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Check the following:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Is ZAP running?<\/li>\n\n\n\n<li>Does the browser use <code>127.0.0.1:8080<\/code>?<\/li>\n\n\n\n<li>Does ZAP listen on port 8080?<\/li>\n\n\n\n<li>Did you configure both HTTP and HTTPS?<\/li>\n\n\n\n<li>Are you using the browser launched by ZAP?<\/li>\n\n\n\n<li>Is a browser extension overriding the proxy?<\/li>\n\n\n\n<li>Is a VPN or corporate security tool controlling the proxy?<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Test with:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>curl -x http:\/\/127.0.0.1:8080 http:\/\/example.com -I\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If the curl request appears in ZAP, the ZAP listener works and the problem is probably in the browser configuration.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Problem 6: Localhost application does not appear<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Browsers may treat loopback destinations differently.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For a local application, the easiest approach is:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Start ZAP.<\/li>\n\n\n\n<li>Open <strong>Manual Explore<\/strong>.<\/li>\n\n\n\n<li>Enter the complete local URL, for example:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>http:&#47;&#47;localhost:3000\n<\/code><\/pre>\n\n\n\n<ol start=\"4\" class=\"wp-block-list\">\n<li>Launch the browser from ZAP.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">This avoids many manual browser bypass problems.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Problem 7: Firefox does not trust the certificate<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">First try using the Firefox instance launched directly by ZAP.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For an existing Firefox profile:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Confirm the ZAP certificate is trusted in macOS Keychain.<\/li>\n\n\n\n<li>Open Firefox network settings.<\/li>\n\n\n\n<li>Select <strong>Use system proxy settings<\/strong>.<\/li>\n\n\n\n<li>Restart Firefox.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Modern Firefox versions can use third-party root certificates from the operating system\u2019s certificate store, subject to the browser\u2019s certificate settings.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Problem 8: ZAP consumes too much memory<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">ZAP stores traffic, site data, responses and scan results.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To reduce usage:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Start a new session for each assessment.<\/li>\n\n\n\n<li>Avoid browsing unrelated websites through ZAP.<\/li>\n\n\n\n<li>Exclude large media files where appropriate.<\/li>\n\n\n\n<li>Do not capture your entire system\u2019s traffic.<\/li>\n\n\n\n<li>Close unused tabs.<\/li>\n\n\n\n<li>Do not run several spiders or scans simultaneously.<\/li>\n\n\n\n<li>Delete temporary sessions after testing.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 25: Disable the macOS Proxy After Testing<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">This step is extremely important when you manually changed the macOS proxy.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Steps<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open the Apple menu.<\/li>\n\n\n\n<li>Open <strong>System Settings<\/strong>.<\/li>\n\n\n\n<li>Select <strong>Network<\/strong>.<\/li>\n\n\n\n<li>Select your active Wi-Fi or Ethernet connection.<\/li>\n\n\n\n<li>Select <strong>Details<\/strong>.<\/li>\n\n\n\n<li>Select <strong>Proxies<\/strong>.<\/li>\n\n\n\n<li>Disable:\n<ul class=\"wp-block-list\">\n<li>Web Proxy (HTTP)<\/li>\n\n\n\n<li>Secure Web Proxy (HTTPS)<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Select <strong>OK<\/strong> or <strong>Done<\/strong>.<\/li>\n\n\n\n<li>Restart the browser if necessary.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Your browser should now connect directly to the internet.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you forget this step and close ZAP, Chrome, Safari and other applications using the system proxy may appear to have no internet connection.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 26: Remove the ZAP Certificate After Testing<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Remove the Root CA when you no longer need to intercept HTTPS through your normal browser.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Steps<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open <strong>Keychain Access<\/strong>.<\/li>\n\n\n\n<li>Select the keychain where you installed the certificate.<\/li>\n\n\n\n<li>Select <strong>Certificates<\/strong>.<\/li>\n\n\n\n<li>Search for:\n<ul class=\"wp-block-list\">\n<li>ZAP<\/li>\n\n\n\n<li>Zed Attack Proxy<\/li>\n\n\n\n<li>ZAP Root CA<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Confirm that you selected the certificate installed for your own ZAP instance.<\/li>\n\n\n\n<li>Right-click it.<\/li>\n\n\n\n<li>Select <strong>Delete<\/strong>.<\/li>\n\n\n\n<li>Enter your administrator password if requested.<\/li>\n\n\n\n<li>Restart your browser.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Do not delete unrelated corporate or operating-system certificates.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 27: Update ZAP<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">The ZAP project recommends using the latest full release and only officially supports the latest full version.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For an installation created with the official package:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Check the official ZAP download page.<\/li>\n\n\n\n<li>Compare your installed version.<\/li>\n\n\n\n<li>Download the latest matching macOS package.<\/li>\n\n\n\n<li>Verify its checksum.<\/li>\n\n\n\n<li>Install the update.<\/li>\n\n\n\n<li>Open <strong>Manage Add-ons<\/strong>.<\/li>\n\n\n\n<li>Install available add-on updates.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">To see your current version:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ZAP \u2192 About ZAP\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">or:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Help \u2192 About\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">depending on the displayed macOS menu layout.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 28: Uninstall ZAP<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">Remove the application<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Quit ZAP.<\/li>\n\n\n\n<li>Open <strong>Finder<\/strong>.<\/li>\n\n\n\n<li>Open <strong>Applications<\/strong>.<\/li>\n\n\n\n<li>Locate ZAP.<\/li>\n\n\n\n<li>Move it to the Trash.<\/li>\n\n\n\n<li>Empty the Trash when appropriate.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Remove associated security configuration<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Also remember to:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Disable the HTTP proxy.<\/li>\n\n\n\n<li>Disable the HTTPS proxy.<\/li>\n\n\n\n<li>Delete the ZAP Root CA certificate from Keychain Access.<\/li>\n\n\n\n<li>Remove unneeded ZAP sessions and reports.<\/li>\n\n\n\n<li>Review retained testing files for sensitive data.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Homebrew uninstall<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">For an installation created through Homebrew:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>brew uninstall --cask zap\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Certificate and proxy cleanup must still be performed manually.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Complete Verification Checklist<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Your configuration is complete when all of the following are true:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91; ] Correct Apple Silicon or Intel installer was downloaded\n&#91; ] Installer checksum was verified\n&#91; ] ZAP starts successfully\n&#91; ] Stable add-ons are updated\n&#91; ] ZAP is in Safe Mode\n&#91; ] Main proxy listens on 127.0.0.1:8080\n&#91; ] A browser launches from Manual Explore\n&#91; ] Browsed URLs appear in the Sites tree\n&#91; ] Requests appear in the History tab\n&#91; ] HTTPS works in the ZAP-launched browser\n&#91; ] Passive alerts can be reviewed\n&#91; ] No unauthorized active scan was performed\n&#91; ] System proxy can be disabled after testing\n&#91; ] Root certificate can be removed when no longer required\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Recommended Workflow for a New ZAP User<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Use this sequence during your first few sessions:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>1. Start ZAP\n2. Choose a temporary session\n3. Select Safe Mode\n4. Update stable add-ons\n5. Open Quick Start\n6. Select Manual Explore\n7. Enter an authorized URL\n8. Launch Chrome or Firefox from ZAP\n9. Browse the application normally\n10. Review Sites\n11. Review History\n12. Review passive Alerts\n13. Close the temporary browser\n14. Exit ZAP\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Avoid manually configuring the entire Mac until you specifically need your normal browser profile.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Final Summary<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">The safest and easiest macOS setup for a beginner is:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Official macOS ZAP installer\n        +\nCorrect Intel or Apple Silicon package\n        +\nChecksum verification\n        +\nSafe Mode\n        +\nQuick Start Manual Explore\n        +\nZAP-launched temporary browser\n        +\nPassive scanning only\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The browser launched by ZAP already uses the correct proxy configuration and handles the testing certificate. This avoids most proxy and HTTPS problems.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Manual browser configuration is needed only when you want to use an existing browser profile. In that case:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ZAP listener:\n127.0.0.1:8080\n\nmacOS HTTP proxy:\n127.0.0.1:8080\n\nmacOS HTTPS proxy:\n127.0.0.1:8080\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You must also export the ZAP Root CA certificate, import it into macOS Keychain Access and explicitly trust it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">After testing, always disable the system proxy and remove the ZAP certificate when it is no longer needed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>SEO title: How to Install and Configure OWASP ZAP Proxy on macOSMeta description: Learn how to install OWASP ZAP on&#8230; <\/p>\n","protected":false},"author":6,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"series":[],"class_list":["post-2951","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>How to Install and Configure OWASP ZAP Proxy on macOS: Complete Beginner\u2019s Guide - DevSecOps School<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/devsecopsschool.com\/blog\/how-to-install-and-configure-owasp-zap-proxy-on-macos-complete-beginners-guide\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Install and Configure OWASP ZAP Proxy on macOS: Complete Beginner\u2019s Guide - DevSecOps School\" \/>\n<meta property=\"og:description\" content=\"SEO title: How to Install and Configure OWASP ZAP Proxy on macOSMeta description: Learn how to install OWASP ZAP on...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/devsecopsschool.com\/blog\/how-to-install-and-configure-owasp-zap-proxy-on-macos-complete-beginners-guide\/\" \/>\n<meta property=\"og:site_name\" content=\"DevSecOps School\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-26T06:36:35+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-07-26T06:36:37+00:00\" \/>\n<meta name=\"author\" content=\"rajeshkumar\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"rajeshkumar\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"18 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/devsecopsschool.com\\\/blog\\\/how-to-install-and-configure-owasp-zap-proxy-on-macos-complete-beginners-guide\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/devsecopsschool.com\\\/blog\\\/how-to-install-and-configure-owasp-zap-proxy-on-macos-complete-beginners-guide\\\/\"},\"author\":{\"name\":\"rajeshkumar\",\"@id\":\"https:\\\/\\\/devsecopsschool.com\\\/blog\\\/#\\\/schema\\\/person\\\/3508fdee87214f057c4729b41d0cf88b\"},\"headline\":\"How to Install and Configure OWASP ZAP Proxy on macOS: Complete Beginner\u2019s Guide\",\"datePublished\":\"2026-07-26T06:36:35+00:00\",\"dateModified\":\"2026-07-26T06:36:37+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/devsecopsschool.com\\\/blog\\\/how-to-install-and-configure-owasp-zap-proxy-on-macos-complete-beginners-guide\\\/\"},\"wordCount\":3917,\"commentCount\":0,\"inLanguage\":\"en\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/devsecopsschool.com\\\/blog\\\/how-to-install-and-configure-owasp-zap-proxy-on-macos-complete-beginners-guide\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/devsecopsschool.com\\\/blog\\\/how-to-install-and-configure-owasp-zap-proxy-on-macos-complete-beginners-guide\\\/\",\"url\":\"https:\\\/\\\/devsecopsschool.com\\\/blog\\\/how-to-install-and-configure-owasp-zap-proxy-on-macos-complete-beginners-guide\\\/\",\"name\":\"How to Install and Configure OWASP ZAP Proxy on macOS: Complete Beginner\u2019s Guide - DevSecOps School\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/devsecopsschool.com\\\/blog\\\/#website\"},\"datePublished\":\"2026-07-26T06:36:35+00:00\",\"dateModified\":\"2026-07-26T06:36:37+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/devsecopsschool.com\\\/blog\\\/#\\\/schema\\\/person\\\/3508fdee87214f057c4729b41d0cf88b\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/devsecopsschool.com\\\/blog\\\/how-to-install-and-configure-owasp-zap-proxy-on-macos-complete-beginners-guide\\\/#breadcrumb\"},\"inLanguage\":\"en\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/devsecopsschool.com\\\/blog\\\/how-to-install-and-configure-owasp-zap-proxy-on-macos-complete-beginners-guide\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/devsecopsschool.com\\\/blog\\\/how-to-install-and-configure-owasp-zap-proxy-on-macos-complete-beginners-guide\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/devsecopsschool.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to Install and Configure OWASP ZAP Proxy on macOS: Complete Beginner\u2019s Guide\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/devsecopsschool.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/devsecopsschool.com\\\/blog\\\/\",\"name\":\"DevSecOps School\",\"description\":\"DevSecOps Redefined\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/devsecopsschool.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/devsecopsschool.com\\\/blog\\\/#\\\/schema\\\/person\\\/3508fdee87214f057c4729b41d0cf88b\",\"name\":\"rajeshkumar\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/787e4927bf816b550f1dea2682554cf787002e61c81a79a6803a804a6dd37d9a?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/787e4927bf816b550f1dea2682554cf787002e61c81a79a6803a804a6dd37d9a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/787e4927bf816b550f1dea2682554cf787002e61c81a79a6803a804a6dd37d9a?s=96&d=mm&r=g\",\"caption\":\"rajeshkumar\"},\"url\":\"https:\\\/\\\/devsecopsschool.com\\\/blog\\\/author\\\/rajeshkumar\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to Install and Configure OWASP ZAP Proxy on macOS: Complete Beginner\u2019s Guide - DevSecOps School","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/devsecopsschool.com\/blog\/how-to-install-and-configure-owasp-zap-proxy-on-macos-complete-beginners-guide\/","og_locale":"en_US","og_type":"article","og_title":"How to Install and Configure OWASP ZAP Proxy on macOS: Complete Beginner\u2019s Guide - DevSecOps School","og_description":"SEO title: How to Install and Configure OWASP ZAP Proxy on macOSMeta description: Learn how to install OWASP ZAP on...","og_url":"https:\/\/devsecopsschool.com\/blog\/how-to-install-and-configure-owasp-zap-proxy-on-macos-complete-beginners-guide\/","og_site_name":"DevSecOps School","article_published_time":"2026-07-26T06:36:35+00:00","article_modified_time":"2026-07-26T06:36:37+00:00","author":"rajeshkumar","twitter_card":"summary_large_image","twitter_misc":{"Written by":"rajeshkumar","Est. reading time":"18 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/devsecopsschool.com\/blog\/how-to-install-and-configure-owasp-zap-proxy-on-macos-complete-beginners-guide\/#article","isPartOf":{"@id":"https:\/\/devsecopsschool.com\/blog\/how-to-install-and-configure-owasp-zap-proxy-on-macos-complete-beginners-guide\/"},"author":{"name":"rajeshkumar","@id":"https:\/\/devsecopsschool.com\/blog\/#\/schema\/person\/3508fdee87214f057c4729b41d0cf88b"},"headline":"How to Install and Configure OWASP ZAP Proxy on macOS: Complete Beginner\u2019s Guide","datePublished":"2026-07-26T06:36:35+00:00","dateModified":"2026-07-26T06:36:37+00:00","mainEntityOfPage":{"@id":"https:\/\/devsecopsschool.com\/blog\/how-to-install-and-configure-owasp-zap-proxy-on-macos-complete-beginners-guide\/"},"wordCount":3917,"commentCount":0,"inLanguage":"en","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/devsecopsschool.com\/blog\/how-to-install-and-configure-owasp-zap-proxy-on-macos-complete-beginners-guide\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/devsecopsschool.com\/blog\/how-to-install-and-configure-owasp-zap-proxy-on-macos-complete-beginners-guide\/","url":"https:\/\/devsecopsschool.com\/blog\/how-to-install-and-configure-owasp-zap-proxy-on-macos-complete-beginners-guide\/","name":"How to Install and Configure OWASP ZAP Proxy on macOS: Complete Beginner\u2019s Guide - DevSecOps School","isPartOf":{"@id":"https:\/\/devsecopsschool.com\/blog\/#website"},"datePublished":"2026-07-26T06:36:35+00:00","dateModified":"2026-07-26T06:36:37+00:00","author":{"@id":"https:\/\/devsecopsschool.com\/blog\/#\/schema\/person\/3508fdee87214f057c4729b41d0cf88b"},"breadcrumb":{"@id":"https:\/\/devsecopsschool.com\/blog\/how-to-install-and-configure-owasp-zap-proxy-on-macos-complete-beginners-guide\/#breadcrumb"},"inLanguage":"en","potentialAction":[{"@type":"ReadAction","target":["https:\/\/devsecopsschool.com\/blog\/how-to-install-and-configure-owasp-zap-proxy-on-macos-complete-beginners-guide\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/devsecopsschool.com\/blog\/how-to-install-and-configure-owasp-zap-proxy-on-macos-complete-beginners-guide\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/devsecopsschool.com\/blog\/"},{"@type":"ListItem","position":2,"name":"How to Install and Configure OWASP ZAP Proxy on macOS: Complete Beginner\u2019s Guide"}]},{"@type":"WebSite","@id":"https:\/\/devsecopsschool.com\/blog\/#website","url":"https:\/\/devsecopsschool.com\/blog\/","name":"DevSecOps School","description":"DevSecOps Redefined","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/devsecopsschool.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en"},{"@type":"Person","@id":"https:\/\/devsecopsschool.com\/blog\/#\/schema\/person\/3508fdee87214f057c4729b41d0cf88b","name":"rajeshkumar","image":{"@type":"ImageObject","inLanguage":"en","@id":"https:\/\/secure.gravatar.com\/avatar\/787e4927bf816b550f1dea2682554cf787002e61c81a79a6803a804a6dd37d9a?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/787e4927bf816b550f1dea2682554cf787002e61c81a79a6803a804a6dd37d9a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/787e4927bf816b550f1dea2682554cf787002e61c81a79a6803a804a6dd37d9a?s=96&d=mm&r=g","caption":"rajeshkumar"},"url":"https:\/\/devsecopsschool.com\/blog\/author\/rajeshkumar\/"}]}},"_links":{"self":[{"href":"https:\/\/devsecopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/2951","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devsecopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devsecopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devsecopsschool.com\/blog\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/devsecopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=2951"}],"version-history":[{"count":1,"href":"https:\/\/devsecopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/2951\/revisions"}],"predecessor-version":[{"id":2952,"href":"https:\/\/devsecopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/2951\/revisions\/2952"}],"wp:attachment":[{"href":"https:\/\/devsecopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=2951"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devsecopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=2951"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devsecopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=2951"},{"taxonomy":"series","embeddable":true,"href":"https:\/\/devsecopsschool.com\/blog\/wp-json\/wp\/v2\/series?post=2951"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}