The Zed Attack Proxy (ZAP), a popular open-source security testing tool, now includes native support for the OWASP Penetration Testing Kit (PTK) as an add-on. This integration marks a meaningful step for application security practitioners who want to bring browser-based security workflows into their ZAP testing environment. With this add-on installed, PTK is automatically included in any browser session launched through ZAP — eliminating the need for manual extension setup.
The result is a seamless combination where ZAP becomes the central traffic hub for capture, proxying, and context (including authentication and session handling), while PTK delivers powerful in-browser security testing capabilities across several modern attack vectors and analysis techniques.
How to Get Started with the OWASP PTK Add-On
To begin using PTK with ZAP:
- Open ZAP’s Marketplace and search for OWASP PTK.
- Install the PTK add-on from the Marketplace.
- Launch a browser (such as Chrome, Edge, or Firefox) through ZAP’s built-in browser launch feature.
- Confirm that the PTK extension icon is present in the launched browser.
- Navigate to the application you want to test and log in before starting scans.
Once these steps are completed, ZAP will handle proxying and session context, while PTK provides dedicated security testing controls within the browser itself.
Dynamic Application Security Testing (DAST)
A key strength of PTK is its browser-centric approach to Dynamic Application Security Testing (DAST). The typical workflow is simple and mirrors real user behavior: start the runtime scan, browse the application like a normal user, stop the scan, and then review findings.
This real navigation-based scanning is especially effective for single-page applications (SPAs) or other rich client-side apps, where automated crawling alone often misses vulnerabilities tied to specific user flows. The recommended routine involves exercising forms, key account sections, search flows, and other critical interactions while the scanner runs in the background.
For safer testing on fragile or production environments, PTK lets you customize scan settings such as request rates and concurrency, helping reduce unintended impacts during live tests.
Instrumenting Runtime Behavior: IAST
PTK’s Interactive Application Security Testing (IAST) operates alongside DAST but focuses on internal signals generated while a session is active. As you interact with the app, IAST instruments and monitors how content behaves at runtime, providing rich contextual findings beyond classic response-pattern analysis.
This approach is especially valuable where client-side behavior (like DOM changes or dynamic routing) affects how vulnerabilities manifest. You simply start the IAST monitor, use the application, stop scans, and then review results in PTK’s built-in dashboard.
Static Application Analysis (SAST) in the Browser
While traditional SAST requires source code access, PTK’s browser-based SAST inspects what is actually loaded and executed in the browser — including inline scripts and external bundles. This is useful when source access isn’t available or when production code differs from repository builds.
PTK’s SAST view highlights risky patterns or code constructs directly from runtime artifacts. Review findings and pivot back to interactive testing (such as DAST/IAST) to verify risks in context.
Software Component Analysis (SCA)
Another valuable dimension that PTK brings is Software Component Analysis (SCA). This workflow reveals dependency and package-level risks for what the application actually loads from third parties or external sources at runtime.
This information helps identify vulnerable or risky components that may otherwise be hidden during regular testing. PTK presents these signals alongside ZAP’s traffic context for deeper investigation.
Request Builder and Targeted Tools
PTK also includes practical utilities like a Request Builder, which helps transform a captured or “interesting” request into a testable hypothesis: edit, replay, manipulate headers, and verify behavior changes.
Alongside this are specialized JWT and cookie tools designed for rapid token inspection, modification, and validation within your authenticated session. These help testers explore authentication logic, token security, and session handling more efficiently.
A Typical Workflow
A recommended daily workflow combining ZAP and PTK might look like this:
- Launch a browser via ZAP with PTK pre-loaded.
- Log in to your target application and browse key features.
- Run PTK’s DAST and IAST tools while interacting with flows.
- Use SAST and SCA to spot client-side and dependency issues.
- Employ JWT and cookie tools to validate authentication logic.
This combined workflow offers both high-level vulnerability discovery and granular analysis, all within authenticated contexts managed by ZAP.
The blog emphasizes responsible use: only conduct active testing with permission, keep scope focused, and adjust scan aggressiveness for production targets. ZAP stays at the core of traffic capture and context, with PTK providing browser-native interactive workflows that enhance discovery and triage.
