ZAP alternatives
Looking for an alternative tool to replace ZAP? During the review of ZAP we looked at other open source tools. Based on their category, tags, and text, these are the ones that have the best match.
Alternatives (by score)
Arachni
Introduction
Arachni is framework written in Ruby with focus on evaluating the security of web applications. Typical users include security professionals and system administrators.
The tooling is free and open source. Besides Linux, it also runs on macOS and Microsoft Windows.
Project details
Arachni is written in Ruby.
Strengths and weaknesses
- + More than 1000 GitHub stars
- + The source code of this software is available
Typical usage
- Penetration testing
- Security assessment
- Web application analysis
Yasuo
Introduction
Yasuo is a Ruby script that scans for vulnerable and exploitable third-party web applications. There are many remotely exploitable vulnerabilities for web applications and their front-end components. Yasuo helps to make it easier to scan for the weaknesses like remote code execution (RCE), SQL injections, and file inclusions.
Project details
Yasuo is written in Ruby.
Strengths and weaknesses
- + The source code of this software is available
Typical usage
- Penetration testing
- Vulnerability scanning
- Web application analysis
SQLMate
Introduction
SQLMate is a tool to perform security assessments and vulnerability of web applications. It can discover admin panels of websites, which might be a way to break into a web application. It also has the option for dorking, which means it can find possible vulnerable targets to a particular attack.
Project details
SQLMate is written in Python.
Strengths and weaknesses
- + The source code of this software is available
- - No releases on GitHub available
Typical usage
- Penetration testing
- Web application analysis
Wfuzz
Introduction
Wfuzz is a fuzzing tool written in Python. Tools like Wfuzz are typically used to test web applications and how they handle both expected as unexpected input.
Project details
Wfuzz is written in Python.
Strengths and weaknesses
- + More than 1000 GitHub stars
- + The source code of this software is available
Typical usage
- Application fuzzing
- Application security
- Application testing
- Web application analysis
w3af
Introduction
W3af is an open source web application attack and audit framework and helps in scanning for vulnerabilities. The tool comes with both a graphical user interface (GUI) and command line utility. Some of the project files include a copyright line of 2006. That gives a good idea on the maturity of the project, and it is one of the rare tools that is still maintained after so many years.
Project details
w3af is written in Python.
Strengths and weaknesses
- + Tool is modular and extendable
- + More than 2000 GitHub stars
- + The source code of this software is available
Typical usage
- Application security
- Application testing
- Penetration testing
- Vulnerability scanning
- Web application analysis
CMSeeK
Introduction
CMSeeK is a security scanner for content management systems (CMS). It can perform a wide range of functions starting from the detection of the CMS, up to vulnerability scanning. The tool claims to support over 100 different CMS tools, with extensive support for the commonly used ones like Drupal, Joomla, and WordPress.
The scans performed by CMSeeK include version detection. It can also do enumeration of users, plugins, and themes. This might be useful to see what users or components are available. The tool includes admin page discovery, file discovery, and directory listing. Anything that might be useful to a penetration test or security assessment, might be displayed.
Project details
CMSeeK is written in Python.
Strengths and weaknesses
- + The source code of this software is available
- - Full name of author is unknown
Typical usage
- Penetration testing
- Software exploitation
- Software identification
- Vulnerability scanning
WordPress Exploit Framework (WPXF)
Introduction
WordPress is still one of the most popular frameworks for websites. A variety of open source tools exist to assess the security of this content management system, and its themes and plugins.
Project details
WordPress Exploit Framework is written in Ruby.
Strengths and weaknesses
- + More than 500 GitHub stars
- + The source code of this software is available
- - Has longer learning curve
Typical usage
- Penetration testing
- Security assessment
- Vulnerability scanning
- Web application analysis
Wordstress
Introduction
WordPress is a popular choice among content management systems (CMS). Powering many websites and blogs, it is also a popular target. So regular updates and security testing can help to reduce the risk. WordStress can help with this testing.
Project details
Wordstress is written in Ruby.
Strengths and weaknesses
- + The source code of this software is available
Typical usage
- Application security
- Vulnerability scanning
- Web application analysis
Wapiti
Introduction
Wapiti is typically used to audit web applications.
Project details
Wapiti is written in Python.
Strengths and weaknesses
- + Project is mature (10+ years)
- + The source code of this software is available
- + Well-known tool
Typical usage
- Application fuzzing
- Vulnerability scanning
- Web application analysis
WhatWeb
Introduction
WhatWeb can be used stealthy and fast to determine what technologies are used on a particular website or web application. This process called fingerprinting can tell a lot about how it was build and possible weaknesses it might have. The tool can be used in different levels, from stealthy to very aggressive. This last one is useful in penetration tests or during development.
Project details
WhatWeb is written in Ruby.
Strengths and weaknesses
- + More than 25 contributors
- + More than 1000 GitHub stars
- + The source code of this software is available
Typical usage
- Reconnaissance
- Web application analysis
JoomScan
Introduction
JoomScan could be used to test your Joomla installation or during security assessments. As it has a primary focus on Joomla, it may provide better results than generic vulnerability scanners.
Project details
JoomScan is written in Perl.
Strengths and weaknesses
- + The source code of this software is available
Typical usage
- Vulnerability scanning
- Vulnerability testing
django-security
Introduction
Django-security is an extension for developers seeking more security measures in their Django project. The toolkit can set or activate particular settings improving security. Examples of these settings include the use of particular HTTP headers that increase the security defenses of the web application.
Part of the toolkit is middleware to enforce password strength, set the do-not-track header, enable content security policy (CSP), enable privacy policy (P3P), limit session length, use HTTPS (HSTS), XSS protection, and more.
Project details
django-security is written in Python.
Strengths and weaknesses
- + More than 10 contributors
- + The source code of this software is available
Typical usage
- Application security
Nikto
Introduction
Nikto helps with performing security scans against web servers and to search for vulnerabilities in web applications.
Project details
Nikto is written in Perl.
Strengths and weaknesses
- + The source code of this software is available
- + Well-known tool
Typical usage
- Penetration testing
- Security assessment
- Web application analysis
shcheck (Security Header Check)
Introduction
This simple tool is a good option to test if advised HTTP headers are available on web application and websites. It can be used as a defensive measure during development, or offensive to find weaknesses in existing applications.
Project details
shcheck is written in Python.
Strengths and weaknesses
- + Very low number of dependencies
- + The source code of this software is available
- - No releases on GitHub available
Typical usage
- Application security
- Web application analysis
wig (WebApp Information Gatherer)
Introduction
Wig is a security tool to discover what particular software is for a web application or website. It can detect several Content Management Systems (CMS) and other administrative applications. This may be useful for those performing reconnaissance or information gathering, like during a penetration test of security assessment.
Project details
wig is written in Python.
Strengths and weaknesses
- + The source code of this software is available
- - No updates for a while
- - Full name of author is unknown
Typical usage
- Application fingerprinting
- Information gathering
- Reconnaissance
- Web application analysis
XSSER
Introduction
XXSER helps to get from XSS to Remote Code Execution (RCE). It provides custom tools and payloads integrated with Metasploit's Meterpreter. The goal is to automate as much as possible.
Project details
XSSER is written in Python.
Strengths and weaknesses
- + The source code of this software is available
- - Minimal or no documentation available
Typical usage
- Penetration testing
- Security assessment
- Web application analysis
seespee
Introduction
Seespee helps to crawl a website and define a suitable Content Security Policy (CSP). The related Content-Security-Policy header can be added with the discovered value. This header defines what local and external resources can be loaded on a website.
Project details
seespee is written in JavaScript.
Strengths and weaknesses
- + The source code of this software is available
Typical usage
- Application security
Commix
Introduction
Commix is short for COMMand Injection eXploiter.
Project details
Commix is written in Python.
Strengths and weaknesses
- + More than 10 contributors
- + More than 1000 GitHub stars
- + The source code of this software is available
DorkNet
Introduction
DorkNet helps with the discovery of vulnerable web apps. It is a script written in Python that leverages Selenium.Project details
DorkNet is written in Python.
Strengths and weaknesses
- + The source code of this software is available
Typical usage
- Security assessment
- Vulnerability scanning
- Web application analysis
Jackhammer
Introduction
The tool uses RBAC (Role Based Access Control) with different levels of access. Jackhammer uses several tools to do dynamic and static code analysis (e.g. for Java, Ruby, Python, and Nodejs). It checks also for vulnerabilities in libraries. Due to its modular architecture, it can use several scanners out of the box, with options to add your own.
The Jackhammer project was initially added to GitHub on the 8th of May, 2017.
Project details
Jackhammer is written in Ruby.
Strengths and weaknesses
- + The source code of this software is available
Typical usage
- Collaboration
- Information sharing
Jawfish
Introduction
Jawfish is a security tool to test web applications. It can find related exploits and update according to an internal database.Project details
Jawfish is written in Python.
Strengths and weaknesses
- + The source code of this software is available
Typical usage
- Penetration testing
- Security assessment
- Vulnerability scanning
- Web application analysis
Susanoo
Introduction
Susanoo is a security tool to test the security of a REST API. With this focus, it goes beyond the typical attack surface of a web application.Project details
Susanoo is written in Python.
Strengths and weaknesses
- + The source code of this software is available
Typical usage
- API testing
- Application testing
ScanSSH
Introduction
ScanSSH is a security tool to perform scans on SSH to detect open proxies and available services. It retrieves version information and related details.Project details
ScanSSH is written in C.
Strengths and weaknesses
- + Project is mature (10+ years)
- + The source code of this software is available
Typical usage
- Information gathering
- Reconnaissance
PTF (The PenTesters Framework)
Introduction
PTF or the PenTesters Framework is a Python script to keep your penetration testing toolkit up-to-date. It is designed for distributions running Debian, Ubuntu, Arch Linux, or related clones. PTF will do the retrieval, compilation, and installation of the tools that you use. As it is a modular framework, you can use many of the common pentesting tools or add your own tools.
Project details
PTF is written in Python.
Strengths and weaknesses
- + More than 50 contributors
- + Tool is easy to use
- + More than 1000 GitHub stars
- + The source code of this software is available
Typical usage
- Penetration testing
- Security assessment
- Software management
- Software testing
Suhosin
Introduction
Suhosin is a security extension for PHP and consists of two parts that enhance PHP. It helps with protecting against known and unknown attacks.Project details
Suhosin is written in C.
Strengths and weaknesses
- + The source code of this software is available
- - Well-known tool
Typical usage
- Application security
Some relevant tool missing as an alternative to ZAP? Please contact us with your suggestion.