OWASP toolchain (ZAP + Dependency-Check)

vZAP 2.15.0 / Dependency-Check 9.2.0OWASP Foundation

OWASP is a foundation, not one product: the range installs its two most used tools plus the reference material. ZAP gives an open intercepting proxy and automated web scanner; Dependency-Check maps a project's libraries to known CVEs. The offline copies of the Top 10, ASVS and the Testing Guide back them up, so findings can be tied to a standard.

Category: Standards, guidance & secure-development tooling
Package: zaproxy
Runs on: Linux · Windows
Commands: zaproxy, zap-cli, dependency-check, owasp
Console: http://zap.range.local:8080

Scans authored web fixtures and authored dependency manifests; the guidance texts are shipped offline.

Install it

The scripts below install the real OWASP Foundation package on your own machine — read them first, and run them somewhere you are allowed to change. Inside the range, one press puts the simulated package on your next machine.

Linux installer (shell script)

install-owasp.sh

Windows installer (PowerShell)

Install-owasp.ps1

On a range machine

Add it to your kit and every machine you launch comes with it.

On Linux

Debian, Ubuntu, Kali (apt)

Refresh the package lists
```
sudo apt update
```
Install OWASP toolchain (ZAP + Dependency-Check)
```
sudo apt install -y zaproxy
```

RHEL, Fedora (dnf)

Install OWASP toolchain (ZAP + Dependency-Check)
```
sudo dnf install -y zaproxy
```
Package names drift between distributions; search first if this one misses.

Arch (pacman)

Install OWASP toolchain (ZAP + Dependency-Check)
```
sudo pacman -S --noconfirm zaproxy
```

Alpine (apk)

Install OWASP toolchain (ZAP + Dependency-Check)
```
sudo apk add zaproxy
```
Package names drift between distributions; search first if this one misses.

Check it worked

Confirm it landed on PATH
```
which zaproxy
```
Check the version
```
zaproxy --version
```
The range reports ZAP 2.15.0 / Dependency-Check 9.2.0.

Remove it

Take it off again
```
sudo apt remove --purge zaproxy
```

On Windows

Windows Package Manager (winget)

Search the catalog
```
winget search zaproxy
```
Install OWASP toolchain (ZAP + Dependency-Check)
```
winget install --id zaproxy -e
```
Package names drift between distributions; search first if this one misses.

Chocolatey (choco)

Install OWASP toolchain (ZAP + Dependency-Check)
```
choco install zaproxy -y
```
Run the shell as administrator.

Check it worked

Confirm it resolves
```
where zaproxy
```
Check the version
```
zaproxy --version
```
The range reports ZAP 2.15.0 / Dependency-Check 9.2.0.

Remove it

Take it off again
```
winget uninstall --id zaproxy
```

Inside the range

Tick it on the launch screen
Under OWASP toolchain (ZAP + Dependency-Check)'s category on the advanced tool shelf. A lab that depends on it locks the toggle on and says why.
Or install it from a range terminal
```
sudo apt install -y zaproxy
```
The simulated package manager seeds the same binaries, config and receipt the shelf toggle does.
Everything here is simulated
No software is downloaded and nothing executes — the range answers from authored fixtures.

Labs that use OWASP toolchain (ZAP + Dependency-Check)

Pentest: Web App Assessment (OWASP Top 10)Assess a storefront with the Burp-lite workbench at /pentest/proxy: repeat a login, fuzz an id parameter, catch an IDOR and a stored XSS, and file each finding under its OWASP Top 10 category.