Back: Catalog

OWASP ZAP

Zed Attack Proxy (ZAP) is an open-source browser used to detect vulnerabilities in web applications. Just as it can perform automatic scanning in development and testing processes, it can also be used for manual safety tests by experienced infiltration testers.

OW

OWASP ZAP

95

zaproxy · Security & Penetration Testing

STARS16.1K
FORKS2.7K
COMMITS—
CONTRIBUTORS274
VERSIONw2026-07-28
UPDATEDtoday
Securityweb-securityScannerowaspApache-2.0

Common commercial products in this category: Burp Suite Professional, Nessus, Cobalt Strike

What can it do?
  • You automatically find vulnerabilities in your web applications in the development and testing stages.
  • You use the tool to detect vulnerabilities in manual infiltration testing processes.
  • As a proxy, you capture browser traffic and examine and modify requests.
Heads up
  • • High number of open issues (875)
Website GitHub

Verified against README · Oct 25, 2026 · source

My note

Alternative pages

Burp Suite Professional alternativesNessus alternativesCobalt Strike alternatives

More in: Security & Penetration Testing