An Automated Web Application Vulnerability Assessment Framework Based on the OWASP ZAP API

Tiara Wigati Septiani; Dendy K Pramudito; Hendra Arya Syaputra

doi:10.37034/infeb.v8i3.1487

An Automated Web Application Vulnerability Assessment Framework Based on the OWASP ZAP API

Tiara Wigati Septiani Universitas Pelita Bangsa Dendy K Pramudito Universitas Pelita Bangsa https://orcid.org/0000-0003-3079-8319 Hendra Arya Syaputra Universitas Pelita Bangsa https://orcid.org/0009-0001-6522-9151 DOI: https://doi.org/10.37034/infeb.v8i3.1487 Keywords: Vulnerability Assessment, OWASP ZAP, Web Security, Rapid Application Development, Penetration Testing Abstract The increasing reliance on web applications has expanded the attack surface and intensified the need for systematic vulnerability assessment. However, manual security testing remains resource intensive and often requires specialized expertise, while fragmented reporting can hinder vulnerability tracking, risk prioritization, and remediation. This study aims to design and develop a web-based vulnerability assessment system integrating the OWASP ZAP API to support automated scanning and centralized security monitoring. The system was developed using the Rapid Application Development methodology, which emphasizes iterative development, rapid prototyping, and reusable components. Its main features include administrator authentication, a monitoring dashboard, automated website scanning, scan history management, vulnerability risk classification, and automated mitigation recommendations. The system also incorporates controlled brute-force testing to assess the resilience of its login mechanism. By integrating scanning, reporting, and remediation guidance within a single interface, the proposed system is intended to reduce the operational complexity of routine vulnerability assessment and improve the accessibility of security information for developers and administrators. The resulting implementation demonstrates the feasibility of integrating OWASP ZAP into a web-based platform for managing vulnerability assessment workflows. Rather than replacing expert security analysis, the system provides a structured mechanism for identifying potential weaknesses, reviewing their reported severity, and supporting remediation decisions. This research contributes a practical implementation approach for integrating open-source security testing tools into application development and maintenance processes, with the broader goal of supporting consistent, traceable, and repeatable vulnerability management. Further empirical evaluation is required to quantify scanning accuracy, execution time, and operational effectiveness across different environments. Downloads Download data is not yet available. References Priyawati, D., Rokhmah, S., & Utomo, I. C. (2022). Website Vulnerability Testing and Analysis of Website Application Using OWASP. International Journal of Computer and Information System (IJCIS), 3(3), 142–147. DOI: https://doi.org/10.29040/ijcis.v3i3.90 . Mayasari, R., Ali Ridha, A., Juardi, D., & Ahmad Baihaqi, K. (2020). Analisis Vulnerability pada Website Universitas Singaperbangsa Karawang menggunakan Acunetix Vulnerability. Systematics, 2(1), 33. DOI: https://doi.org/10.35706/sys.v2i1.3450 . Hermanto, H., & Haeruddin, H. (2022). Peningkatan Sistem Keamanan Website Menggunakan Metode OWASP. Jurnal Ilmu Komputer dan Bisnis, 13(1), 94–104. DOI: https://doi.org/10.47927/jikb.v13i1.277 . Abdul Fattah Hasibuan, Tommy, & Divi Handoko. (2023). Analisis Keretanan Website dengan Aplikasi Owasp Zap. Jurnal Ilmu Komputer dan Sistem Informasi, 2(2), 257–270. DOI: https://doi.org/10.70340/jirsi.v2i2.51 . Tara, T. R., & W, Y. (2023). Analisis Keamanan Website Sistem Informasi Administrasi Kependudukan Menggunakan Metode Vulnerability Assesment. Jurnal Teknologi Informatika dan Komputer (JURTIKOM), 1(1), 1–9. DOI: https://doi.org/10.51401/jurtikom.v1i1.3172 . Zahra, N. A., Zidane, F. H., & Kuslaila, N. R. (2023). Analisis Keamanan Sistem Informasi pada Website PT Sentra Vidya Utama (SEVIMA) Menggunakan Metode OWASP. Prosiding Seminar Nasional Teknologi dan Sistem Informasi, 3(1), 384–393. https://doi.org/10.33005/sitasi.v3i1.564 . Kurniawan, H., & Christianto, E. (2024). Analysis Vulnerability Website Baleomolcreative dengan Metode Penetration Testing Execution Standard & Vulnerability Assessment pada Http Response Header Field. Jurnal JTIK (Jurnal Teknologi Informasi dan Komunikasi), 8(3), 734–745. DOI: https://doi.org/10.35870/jtik.v8i3.2202 . Ade Gustiyonoo, Irawadi Alwi, E., & Mubarak Abdullah, S. (2024). Analisa Kerentanan Website terhadap Serangan Cross-Site Scripting (XSS) Metode Penetration Testing. Cyber Security dan Forensik Digital, 7(1), 25–33. DOI: https://doi.org/10.14421/csecurity.2024.7.1.4432 . Haeruddin, Gautama Wijaya, Winata, H., Sukma Aji, & Muhammad Nur Faiz. (2024). Website Security Analysis Using Vulnerability Assessment Method. Journal of Innovation Information Technology and Application (JINITA), 6(2), 173–180. DOI: https://doi.org/10.35970/jinita.v6i2.2476 . Rahman, A., Indra, I., Zulkarnaim, N., Mukhram, M., & Rizaldi, A. (2025). Analisis Implementasi Nucklei Vulnerability dan Owasp-Zap Scanner untuk Deteksi Kerentanan Keamanan (Secure System) pada Platform Web Based. Jurnal Komputer Terapan, 11(1), 10–15. DOI: https://doi.org/10.35143/jkt.v11i1.6430 . Pramuja Inngam Fanani, G., Muhammad Amirul Mu’min, & Tristanti, N. (2025). Analisis dan Pengujian Kerentanan Website Menggunakan OWASP ZAP. Jurnal Riset Sistem dan Teknologi Informasi, 3(1), 36–50. DOI: https://doi.org/10.30787/restia.v3i1.1886 . Eko setiawan, & Fachri, F. (2025). Pengujian dan Mitigasi Kerentanan Website Sistem Informasi Akademik Universitas Ma’arif Nahdlatul Ulama Kebumen dengan OWASP ZAP. Cyber Security dan Forensik Digital, 8(1), 25–33. DOI: https://doi.org/10.14421/csecurity.2025.8.1.5190 . Muhamad Wafa Miftahul Anwar, & Fahmi Fachri. (2025). Analisis Keamanan Website Planet Komputer Kebumen Menggunakan Metode Vulnerability Assessment dengan Temuan 4 Kerentanan Tingkat Menengah. Rabit: Jurnal Teknologi dan Sistem Informasi Univrab, 10(2), 373–382. DOI: https://doi.org/10.36341/rabit.v10i2.6083 . Nisa, F., Nurfebruary, N. S., & Ikhwani, M. (2024). Analisis Keamanan Sistem Informasi Website Portal Akademik Universitas Malikussaleh Menggunakan OWASP ZAP. Jurnal Nasional Komputasi dan Teknologi Informasi (JNKTI), 7(6). DOI: https://doi.org/10.32672/jnkti.v7i6.8345 . Putra Pura, C. B., Maulana, T. Y., Februri, A., & Ariyadi, T. (2025). Analisis Celah Keamanan Website Menggunakan Tools OWASP ZAP di Kali Linux. JUSTER: Jurnal Sains dan Terapan, 4(1), 46–51. DOI: https://doi.org/10.57218/juster.v4i1.1341 Putra Pratama Hendrico, F., Pahrizal, P., & Utami, M. (2022). Penggunaan Tahapan Prototype Model pada Perancangan Alur Sistem Informasi Desa Taba Mulan. JUSIBI (Jurnal Sistem Informasi dan E-Bisnis), 4(1), 10–19. DOI: https://doi.org/10.54650/jusibi.v4i1.425 . Wulandari, A. S., Saepudin, A., Kinanti, M. P., Sudesi, Z., Saifudin, A., & Yulianti, Y. (2022). Pengujian Aplikasi Sistem Informasi Akademik Berbasis Web Menggunakan Metode Black Box Testing Equivalence Partitioning. Jurnal Teknologi Sistem Informasi dan Aplikasi, 5(2), 102. DOI: https://doi.org/10.32493/jtsi.v5i2.17561 . Aura Arnelia Zahrani, Dzihni Safwa Alifah, Yulia Cahyani, & Ilham Albana. (2025). Analisis Vulnerability Assessment pada Sistem Informasi Website IITC Intermedia Universitas Amikom Purwokerto Menggunakan OWASP ZAP. Bridge: Jurnal Publikasi Sistem Informasi Dan Telekomunikasi, 3(2), 55–68. DOI: https://doi.org/10.62951/bridge.v3i2.425 . Aura Arnelia Zahrani, Dzihni Safwa Alifah, Yulia Cahyani, & Ilham Albana. (2025). Analisis Vulnerability Assessment pada Sistem Informasi Website IITC Intermedia Universitas Amikom Purwokerto Menggunakan OWASP ZAP. Bridge: Jurnal Publikasi Sistem Informasi Dan Telekomunikasi, 3(2), 55–68. DOI: https://doi.org/10.62951/bridge.v3i2.425 . Kartono, F. K., Nursaadah, S., Nugroho, M. R., Tama, D. A., Mashudi, F. A., Wicaksono, A., & Nasir, M. (2024). Pengujian Black Box Testing Pada Sistem Website Osha Snack: Pendekatan Teknik Boundary Value Analysis. Jurnal Kridatama Sains dan Teknologi, 6(02), 754–766. DOI: https://doi.org/10.53863/kst.v6i02.1407 .	Download Published 2026-09-30 Issue Vol. 8, No. 3 (September 2026) Section Articles How to Cite Septiani, T. W., Pramudito, D. K., & Syaputra, H. A. (2026). An Automated Web Application Vulnerability Assessment Framework Based on the OWASP ZAP API. Jurnal Informatika Ekonomi Bisnis, 8(3), 651-660. https://doi.org/10.37034/infeb.v8i3.1487 ACM ACS APA ABNT Chicago Harvard IEEE MLA Turabian Vancouver Download Citation Endnote/Zotero/Mendeley (RIS) BibTeX This work is licensed under a Creative Commons Attribution 4.0 International License.