Home › Tool guides › OWASP ZAP (web app scanning)

OWASP ZAP (web app scanning)

An open-source web application scanner. Use the baseline scan against your own staging Odoo and portal to find missing headers and common issues. Only scan systems you own or are authorised to test.

Official site: www.zaproxy.org/
Licence: Free (Apache-2.0)

With Odoo

• Findings often point to proxy headers (HSTS, X-Content-Type-Options) rather than Odoo code.
• Custom controllers deserve manual review too (lesson d15).

The full room (install, configure, use, troubleshooting, management and a hands-on checklist) is in the academy.

Open the OWASP ZAP (web app scanning) room