Intercepting proxy and DAST scanner for web apps
Web application security scanner and intercepting proxy, formerly OWASP ZAP, with automated scans, a desktop UI, an API and a large add-on marketplace.
ZAP (Zed Attack Proxy) sits between a browser and a web application, records the traffic and lets a tester inspect and replay requests. On top of the proxy it runs passive checks on every response and active scans that probe for common vulnerability classes such as injection and cross-site scripting.
ZAP was an OWASP project until 2023. It is now an independent open-source project controlled by the ZAP Core Team and supported by Checkmarx, which employs several core team members, hence the name "ZAP by Checkmarx". It remains Apache-2.0 licensed and is widely used both for manual testing and as an automated DAST step in CI pipelines through its Docker images and automation framework.
Apache-2.0 · Apache License 2.0 · Open source
Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: Apache-2.0.
1 published advisory for ZAP in GitHub repository advisories and OSV.dev. Keep the tool updated: security tools often run with broad access.
GHSA-j7xg-5549-jr3jCVE-2022-27820moderate2022-03-25
Improper Certificate Validation in OWASP ZAP
Sources: GitHub repository advisories, OSV.dev · checked 2026-10-20.
Interactive TLS-capable intercepting HTTP proxy
Interactive HTTPS proxy with a terminal UI (mitmproxy), a web UI (mitmweb) and a scriptable command-line tool (mitmdump) driven by Python add-ons.
Automated SQL injection detection and testing
Command-line tool that automates the detection and confirmation of SQL injection flaws in web applications, with support for many database engines.
Fast web fuzzer for content and parameter discovery
Fast web fuzzer written in Go, used to discover hidden files, directories, virtual hosts and parameters by replacing a FUZZ keyword with wordlist entries.
Template-based vulnerability scanner
Fast vulnerability scanner driven by YAML templates, with thousands of community templates for CVEs, misconfigurations and exposures across many protocols.
Web server scanner for dangerous files and misconfigurations
Long-running open-source web server scanner that checks for dangerous files, outdated server software and common misconfigurations.
Penetration testing framework
Rapid7's open-source framework for developing, testing and running exploit modules and auxiliary checks in authorised security assessments.
