OWASP’s Zed Attack Proxy just received a transformative upgrade that closes a long-standing blind spot in web application security testing, client-side vulnerabilities hidden deep within the browser’s execution context.
The release of ZAP PTK Add-On 0.3.0, working in tandem with OWASP PenTest Kit (PTK) 9.8.0, now converts browser-based security findings directly into native ZAP alerts, surfacing them in the same dashboard where security professionals already live.
The Proxy Blind Spot Problem
ZAP has long been the gold standard for proxy-layer analysis, HTTP headers, server-side behavior, request/response inspection, and passive and active scanning.
But modern Single Page Applications (SPAs) have fundamentally shifted the threat landscape. Critical security flaws now reside inside the browser’s runtime execution context, never triggering full page loads or sending recognizable payloads back through the proxy.
Vulnerabilities like DOM-based Cross-Site Scripting (XSS), dangerous JavaScript sinks eval() and unsafe innerHTML usage, and tainted data-flows in minified third-party bundles remain completely invisible to standard proxy-based scanners.
These are not edge cases; they represent an entire category of client-side risk that traditional tooling structurally cannot observe.
The PTK add-on solves this by running directly inside the browsers launched by ZAP Chrome, Firefox, and Edge, monitoring runtime signals and analyzing client-side code in real time.
Version 0.3.0 introduces three major capabilities
- Native ZAP Alerts — PTK findings are surfaced directly into ZAP’s Alerts tab, integrating seamlessly into existing triage, filtering, and reporting workflows.
- Custom Rule Selection — Testers can selectively enable SAST, IAST, and DAST scanning engines to match their testing objective.
- Auto-Start Scanning — PTK scanning can begin automatically the moment a ZAP browser session launches.
The update delivers a massive jump in coverage: ZAP now carries 142 OWASP PTK-tagged alert types, a significant expansion of its client-side detection capabilities.
PTK IAST monitors runtime behavior, flagging tainted inputs that reach sensitive DOM operations even when server responses appear completely normal to the proxy.
PTK SAST, meanwhile, analyzes the actual JavaScript bundles the browser executes, catching unsafe patterns like dangerous innerHTML manipulation or risky third-party scripts that production builds introduce.
Testing this integration is straightforward using OWASP Juice Shop as a deliberately vulnerable target.
Install or update the OWASP PTK add-on from the ZAP Marketplace, configure SAST/IAST/DAST engines under Tools → Options → OWASP PTK, launch a browser via ZAP’s Quick Start, browse through authenticated workflows, manually trigger a PTK scan, and review client-side findings alongside standard proxy alerts in ZAP’s Alerts tab.
The ZAP team has confirmed that full automation is the next milestone, enabling PTK and ZAP to function as a unified CI-style scanning pipeline for modern web application security testing.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google
.webp?fit=1600,900&ssl=1&description=The release of ZAP PTK Add-On 0.3.0, working in tandem with OWASP PenTest Kit (PTK) 9.8.0, now converts browser-based security findings directly into native ZAP alerts){kind=link}