Alternatives to Burp Suite Community Edition
PortSwigger's free web security testing toolkit, for intercepting, inspecting and modifying HTTP traffic by hand. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
Burp Suite Community Edition
PortSwigger's free web security testing toolkit, for intercepting, inspecting and modifying HTTP traffic by hand.
Replacements
Listings that take over the same core job as Burp Suite Community Edition.
ZAP
Open-source web application security scanner and intercepting proxy.
ZAP is an open-source Apache-2.0 intercepting proxy that includes automated scanning and an automation framework for CI, which Burp Community lacks, though it is also a heavy Java application.
ZAP
Inspect and test web applications with the ZAP security proxy.
ZAP combines manual request inspection with automated scanning tools under an Apache-2.0 open-source licence, removing the Community Edition's missing scanner and rate-limited fuzzing.
Caido
Web security testing proxy for auditing web applications.
Caido offers a modern, lighter interception proxy with a workflow engine and plugins, but it is also closed source and its free edition holds back automation and collaboration.
mitmproxy
An intercepting proxy that decrypts, displays and lets you modify HTTP and HTTPS traffic, with a console, a web interface and a scriptable command-line version.
mitmproxy is an MIT-licensed intercepting proxy with console, web and Python scripting interfaces, suited more to inspecting app traffic than to a full web testing workflow.
Also worth comparing
These listings name Burp Suite Community Edition as their own alternative, so the relationship runs both ways.
ffuf
Test variations in HTTP requests with a command-line fuzzer.
Burp Suite Community is a closed-source graphical proxy whose Intruder fuzzing tool is rate-limited in the free edition, alongside manual interception and repeater.
Similar software
Related functionality, not a direct replacement.
sqlmap
Automates detecting and exploiting SQL injection flaws, for testing your own applications before someone else does.
Dalfox
Check web applications for cross-site scripting issues.
Nuclei
A fast vulnerability scanner driven by YAML templates contributed by thousands of security researchers.
Interactsh
Collect external callbacks during authorized security tests.
SecLists
Find reusable test data for authorized security assessments.
