How to Scan Your Self-Hosted Apps with OWASP ZAP

Network-level tools like Nmap tell you which ports are open, but they can’t tell you whether the web application running behind one of those ports has an actual vulnerability in its code or configuration. An OWASP ZAP web vulnerability scan fills that gap, testing self-hosted applications directly for common web security issues before someone else finds them first.

What Is OWASP ZAP?

OWASP ZAP (Zed Attack Proxy) is a free, open-source web application security scanner maintained by the OWASP Foundation. It acts as an intercepting proxy and active scanner, capable of both passively observing traffic to a web application and actively probing it for common vulnerability classes like SQL injection, cross-site scripting (XSS), and insecure configuration issues.

Why Scan Your Own Self-Hosted Apps

Homelab users often run several self-hosted web applications — Nextcloud, a custom dashboard, a personal wiki — and it’s easy to assume popular open-source software is inherently secure simply because many people use it. Regularly scanning your own deployments catches misconfigurations specific to your setup, outdated versions with known vulnerabilities, or exposed debug endpoints that shouldn’t be reachable in a production-like environment.

Installing OWASP ZAP

ZAP is available as a desktop application or via Docker:

docker pull zaproxy/zap-stable

For a quick scan without launching the full GUI:

docker run -t zaproxy/zap-stable zap-baseline.py -t http://your-app-ip:port

Running a Passive (Baseline) Scan

The baseline scan is the safest starting point, passively crawling the target application and checking responses for common issues without actively attempting to exploit anything:

docker run -t zaproxy/zap-stable zap-baseline.py -t http://192.168.1.50:8080 -r baseline-report.html

This generates an HTML report summarizing potential issues found, ranked by severity.

Running a Full Active Scan

For a more thorough test, the full scan actively attempts common attack patterns against the target application:

docker run -t zaproxy/zap-stable zap-full-scan.py -t http://192.168.1.50:8080 -r full-report.html

Important: active scans send genuinely malicious-looking payloads to the target, which can cause errors, unexpected behavior, or even data changes in poorly written applications — only run active scans against your own applications, never anything you don’t own or have explicit permission to test.

Understanding Common Findings

ZAP reports typically flag issues such as:

• Missing security headers – like Content-Security-Policy or X-Frame-Options, which help protect against certain browser-based attacks
• Outdated software versions – detected through response headers or known version-specific behavior
• Insecure cookie configuration – cookies missing the Secure or HttpOnly flags
• Information disclosure – verbose error messages or debug information exposed to users

Prioritizing What to Fix

Not every flagged item carries equal risk. Focus first on high and medium severity findings that are actually exploitable in your specific setup — a missing security header on an internal-only dashboard behind a VPN carries much less real risk than the same issue on something exposed to the public internet.

Integrating ZAP into a Regular Routine

Rather than a one-time scan, consider running a baseline scan against your self-hosted applications periodically (monthly, or after major updates to any of them) to catch new issues introduced by updates or configuration changes over time, similar in spirit to how Nmap scans help maintain network-level awareness.

Responsible Use

OWASP ZAP is a legitimate security testing tool, but like Nmap, it should only ever be pointed at systems you own or have explicit permission to test. Scanning third-party websites or applications without authorization is both unethical and illegal in most jurisdictions.

Final Thoughts

Running an OWASP ZAP web vulnerability scan against your own self-hosted applications adds a layer of security awareness that network scanning alone can’t provide, catching application-level issues before they become a real problem. Combined with regular Nmap network audits, it rounds out a genuinely thorough approach to auditing your own homelab’s security posture.