Alternatives to ZAP
Open-source web application security scanner and intercepting proxy. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
ZAP
Open-source web application security scanner and intercepting proxy.
Replacements
Listings that take over the same core job as ZAP.
ZAP
Inspect and test web applications with the ZAP security proxy.
This ZAP listing is the same Apache-2.0 security proxy on Windows, macOS and Linux, combining manual request inspection with automated scanning tools.
Burp Suite Community Edition
PortSwigger's free web security testing toolkit, for intercepting, inspecting and modifying HTTP traffic by hand.
Burp Suite Community Edition is closed source and freemium, with a standard intercepting proxy and repeater, but no automated scanner and a rate-limited Intruder.
Caido
Web security testing proxy for auditing web applications.
Caido is a closed-source freemium proxy with a modern, fast interface, workflow engine and plugins, while its free edition holds back automation and collaboration features.
mitmproxy
An intercepting proxy that decrypts, displays and lets you modify HTTP and HTTPS traffic, with a console, a web interface and a scriptable command-line version.
mitmproxy is an MIT-licensed intercepting proxy with console, web and scriptable modes and Python scripting, but it has no automated vulnerability scanner.
Wapiti
Check web applications with a Python-based vulnerability scanner.
Wapiti is a Python command-line web vulnerability scanner for Linux and macOS, offering automated tests without an intercepting proxy or graphical interface.
Nuclei
A fast vulnerability scanner driven by YAML templates contributed by thousands of security researchers.
Nuclei scans with community YAML templates from the command line and fits CI/CD, but it has no intercepting proxy and misses untemplated vulnerabilities.
Pentest-Tools.com
An online toolkit of vulnerability scanners and penetration testing tools that produces customizable reports.
Pentest-Tools.com runs vulnerability scans in the browser on vendor infrastructure with customizable reports, moving from free open source to a commercial service with paid plans.
Also worth comparing
These listings name ZAP as their own alternative, so the relationship runs both ways.
Nikto
Web server scanner for risky files, outdated software and misconfigurations.
ZAP adds an intercepting proxy and automated application scanning in a Java desktop tool, with an API for CI pipelines, rather than Nikto's server-focused path checks.
Similar software
Related functionality, not a direct replacement.
sqlmap
Automates detecting and exploiting SQL injection flaws, for testing your own applications before someone else does.
XSStrike
Cross-site scripting detection suite with context analysis.
Dalfox
Check web applications for cross-site scripting issues.
ffuf
Test variations in HTTP requests with a command-line fuzzer.
dirsearch
Web path scanner for discovering hidden directories and files.
