Open Source Tools · Alternatives
Burp Suite Professional is PortSwigger's commercial toolkit for web application security testing: an intercepting proxy, an automated scanner and manual testing tools. Teams that want an open-source stack usually combine an intercepting proxy such as ZAP or mitmproxy with dedicated fuzzers and template-based scanners.
Burp Suite Professional is a commercial product by PortSwigger (official site). Category: Web application testing.
| Tool | Licence | Stars | Last commit | Best for |
|---|---|---|---|---|
 mitmproxy | MITOpen source | 46k | today | Interactive TLS-capable intercepting HTTP proxy |
 sqlmap | GPL-2.0-or-laterOpen source | 39k | today | Automated SQL injection detection and testing |
 ffuf | MITOpen source | 17k | 23 days ago | Fast web fuzzer for content and parameter discovery |
 ZAP | Apache-2.0Open source | 16k | 4 days ago | Intercepting proxy and DAST scanner for web apps |
Interactive TLS-capable intercepting HTTP proxy
Interactive HTTPS proxy with a terminal UI (mitmproxy), a web UI (mitmweb) and a scriptable command-line tool (mitmdump) driven by Python add-ons.
Automated SQL injection detection and testing
Command-line tool that automates the detection and confirmation of SQL injection flaws in web applications, with support for many database engines.
Fast web fuzzer for content and parameter discovery
Fast web fuzzer written in Go, used to discover hidden files, directories, virtual hosts and parameters by replacing a FUZZ keyword with wordlist entries.
Intercepting proxy and DAST scanner for web apps
Web application security scanner and intercepting proxy, formerly OWASP ZAP, with automated scans, a desktop UI, an API and a large add-on marketplace.
Product names are trademarks of their owners. ThreatWire is not affiliated with PortSwigger. The comparison covers what each tool is designed to do, not a feature-by-feature equivalence.
