Alternatives to ZAP
Inspect and test web applications with the ZAP security proxy. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
ZAP
Inspect and test web applications with the ZAP security proxy.
Replacements
Listings that take over the same core job as ZAP.
ZAP
Open-source web application security scanner and intercepting proxy.
ZAP is the same open-source Apache-2.0 proxy and scanner listed separately, with its API and automation framework noted for CI pipeline use.
Burp Suite Community Edition
PortSwigger's free web security testing toolkit, for intercepting, inspecting and modifying HTTP traffic by hand.
Burp Suite Community is closed source and Java-based, with a standard intercepting proxy and repeater, but no automated scanner and a rate-limited Intruder.
Caido
Web security testing proxy for auditing web applications.
Caido is a lighter, closed-source interception proxy with a workflow engine and plugins, whose free community edition holds back automation features.
mitmproxy
An intercepting proxy that decrypts, displays and lets you modify HTTP and HTTPS traffic, with a console, a web interface and a scriptable command-line version.
mitmproxy is an MIT-licensed intercepting proxy with console, web and scriptable interfaces and Python scripting, but no built-in vulnerability scanner.
Wapiti
Check web applications with a Python-based vulnerability scanner.
Wapiti is a Python command-line scanner for automated web application tests, without ZAP's intercepting proxy for manual inspection.
Nikto
Web server scanner for risky files, outdated software and misconfigurations.
Nikto is a command-line web server scanner using signatures for risky files and misconfigurations, with no proxy or application crawling.
Also worth comparing
These listings name ZAP as their own alternative, so the relationship runs both ways.
Commix
Open-source tool that detects and exploits command injection vulnerabilities in web applications.
ZAP combines an intercepting proxy with automated scanning for a range of web flaws, broader but less specialised than Commix's command injection focus.
Dalfox
Check web applications for cross-site scripting issues.
ZAP is a Java desktop proxy combining manual inspection with automated scanning, so it covers cross-site scripting among many other web vulnerability classes.
Similar software
Related functionality, not a direct replacement.
sqlmap
Automates detecting and exploiting SQL injection flaws, for testing your own applications before someone else does.
XSStrike
Cross-site scripting detection suite with context analysis.
ffuf
Test variations in HTTP requests with a command-line fuzzer.
Nuclei
A fast vulnerability scanner driven by YAML templates contributed by thousands of security researchers.
OWASP Juice Shop
An intentionally insecure web shop covering the OWASP Top Ten, used for security training and CTFs.
