Hope , the ZAP core team fulfill this.

[Prabin Baniya]

My feedback to ZAP project and it's core team.

Zap Proxy 

       ↓

Very capable platform

        ↓

Documentation + add-ons

        ↓

Automation Framework / API / MCP / LLM

        ↓

But fewer structured ZAP-specific practical exercises / labs.

Who am I ? @prabinBNYFXBB , 22 yrs old , a noob , beginner in web pentesting . I first came across burpsuite in 2023 through tryhackme platform . Later learn , Portswigger's Web Security Acedemy labs and try solving thems . And they are well made across burpsuite and more than 35% labs need PRO edition not community one , so after that I find about ZAP proxy , an open source , free proxy (comparable to Burpsuite pro and more) and solving portswigger labs but it's painful to learn two proxies side by side comparing each proxies , UI features as acedemy's labs solutions are based on burpsuite UI. 

One similar but interesting incident is happening which I think I should discussed here , in ZAP proxy while doing fuzzing I found simple, cluster bomb modes only at first and then I wrote script for batterRam and pitchfork with help of AI , but later found , it has Breadth first , and Depth first modes , meaning all four fuzzing modes possible are available . Similarities there are too many things we don't know about it's features .

( My request to the ZAP team )

Could the ZAP project consider creating an official: "ZAP Desktop Academy" or "ZAP Feature Labs" focused specifically on learning the ZAP application through hands-on exercises? ZAP already has the technology, documentation, add-ons, automation capabilities , API , MCP , and test applications.

What I think would complete the ecosystem is a structured practical learning layer that teaches people how to actually use all of it.

That would make ZAP much easier for beginners to learn without having to constantly translate workflows from Burp Suite.

[ar]

What ZAP already has (albeit in a fragmented way)
ZAP is moving toward interactive learning, but these initiatives have not yet been consolidated into a unified "Academy":
• ZAP Webswing / Browser-based Tutorials: ZAP developers have experimented with Webswing technology, which allows the full ZAP Desktop application to run directly in a browser. This provides an ideal foundation for interactive labs (similar to the PortSwigger Web Security Academy).
• Test applications: ZAP has its own vulnerable applications, such as the BodgeIt Store, and integrates with OWASP Juice Shop.
2. How can the project consider your idea?
Since ZAP is managed by a core team led by Simon Bennetts, they are open to suggestions—especially if the community is willing to help implement them. You can formally propose this concept via:
• ZAP User Group (Google Groups): The primary venue for discussing strategic ideas and features. Post a description of your "ZAP Feature Labs" concept there.
• GitHub Issues / Discussions: You can start a discussion in the main `zaproxy/zaproxy` repository, proposing the creation of a roadmap for an educational resource.
• ZAP Evangelism: The ZAP team actively seeks contributors not only for coding but also for creating educational content. If you propose a course structure, it is highly likely to receive support.

Best regards, ar

вс, 4 окт. 2026 г. в 05:25, Prabin Baniya <prabi...@gmail.com>:

--
ZAP by Checkmarx: https://www.zaproxy.org/
---
You received this message because you are subscribed to the Google Groups "ZAP User Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to zaproxy-user...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/zaproxy-users/CAD%2BNcUfCNwgs%3DgiJcqgkYBkCVZ7HSCnQSaZQzoWt%3DpnXsZarLw%40mail.gmail.com.

[ar]

Yes, the ZAP (Zed Attack Proxy) project could certainly consider such an initiative, given its team's history of supporting educational projects (such as the ZAP HUD learning app or the dedicated WebGoat training site). However, as an open-source project, the realization of "ZAP Desktop Academy" largely depends on community engagement and the willingness of sponsors to fund content creation.
Artificial Intelligence (AI) integration could be the key factor in overcoming the resource constraints associated with writing hundreds of hands-on scenarios.
🤖 How AI Can Power "ZAP Desktop Academy"
Leveraging modern Large Language Models (LLMs) and agents enables the automation of interactive course creation and completion:
• Adaptive Lab Generation: AI can generate unique vulnerable web applications (or Docker containers) on the fly, tailored to a user's specific task (e.g., "generate an IDOR vulnerability in a REST API and teach me how to detect it using ZAP").
• In-ZAP AI Mentor: Through integration with the ZAP MCP (Model Context Protocol), AI can operate directly within the ZAP interface. It can highlight relevant buttons, suggest the appropriate tool (Fuzzer, Spider, Active Scan) for the current context, and verify the correctness of the user's actions.
• Burp Suite Migration Generator: AI can instantly translate workflows familiar to Burp Suite users (such as using Intruder or Repeater) into ZAP equivalents (Fuzzer and Request Editor), providing personalized guidance for those switching from Burp. • Interactive assignment verification: Instead of static tests, AI can analyze the request history or a saved ZAP session to confirm that the educational vulnerability was correctly identified and exploited.

Best regards,ar

пн, 5 окт. 2026 г. в 06:21, ar <rasti...@gmail.com>:

[ar]

I really don't have the time...

пн, 5 окт. 2026 г. в 06:24, ar <rasti...@gmail.com>:

[Simon Bennetts]

Hiya,

This is something we've talked about, and would really like to do.

Unfortunately we just do not have enough people to work on it.

There's only 3 of us working on ZAP full time, compared with the 120+ who work on Burp Suite.

But .. dont forget that ZAP is a community project, and anyone can get involved.

So if anyone fancies working on something like this then just say!

Many thanks,

Simon