How to Extend ZAP with Add-ons from the ZAP Marketplace

Updated

ZAP (Zed Attack Proxy) can be extended through the ZAP Marketplace, which hosts add-ons contributed by the community. According to zaproxy.org, these add-ons are how you extend ZAP's functionality beyond the core scanner. The site points readers to the Marketplace to see how add-ons work and how to add them; the exact in-app menu path is not specified in the available material, so use the Marketplace entry linked from zaproxy.org as your starting point.

What the ZAP Marketplace is

ZAP is described on its site as "the world's most widely used web app scanner," free and open source, and a community-based GitHub Top 1000 project that anyone can contribute to. The Marketplace fits that model: it is the distribution point for add-ons "contributed by the community," and the site frames it as the way to "extend ZAP with the add-ons."

Two things follow from this:

  • Add-ons are optional extensions. The core download gives you ZAP itself; the Marketplace is where you add capabilities on top.
  • The catalog is community-driven. Add-ons come from contributors rather than a single vendor team, so the set of available add-ons and their maturity can vary.

How to approach extending ZAP

The site does not publish a step-by-step Marketplace tutorial in the material available, so the reliable path is:

  1. Start from zaproxy.org. The homepage links to the Marketplace section alongside Blog, Videos, Documentation, Community, and Download.
  2. Read the Marketplace guidance there before installing anything, so you know what the add-ons are for and how they are described.
  3. Check the Documentation for the specific feature you want to extend; add-on behavior is documented per add-on rather than in one place.
  4. Verify the result by confirming the new capability appears and behaves as described in that add-on's documentation.

Common sticking points

  • Assuming add-ons are bundled. They are separate from the base download; you add them through the Marketplace.
  • Skipping the docs. Because add-ons are community-contributed, quality and documentation depth differ between them. Read the specific add-on's page rather than relying on the general description.
  • Expecting a fixed menu path. The available material does not specify exact in-app menu locations, so follow the Marketplace link on zaproxy.org and the documentation rather than a memorized click path.

Who this is for

Extending via the Marketplace suits you if you already have ZAP installed and want to add functionality for a specific testing or automation need. If you are new to security testing, the site recommends starting with the ZAP Quick Start Guide first; if your goal is automation, it points to the automation docs. The Marketplace is the next step once you know which capability you need.

Contributing back

Because ZAP is an open-source, community-based project that "anyone can contribute to," the Marketplace is also an entry point for contribution: add-ons are contributed by the community, and the project invites participation through its Community links. If you build or improve an add-on, that is the channel the project describes.

For the current list of add-ons and their descriptions, use the Marketplace link on zaproxy.org; the site does not enumerate the catalog in the material available here.