ZAP alternatives

Looking for an alternative tool to replace ZAP? During the review of ZAP we looked at other open source tools. Based on their category, tags, and text, these are the ones that have the best match.

Top 3

  1. Arachni (web application scanner)
  2. Yasuo (vulnerability scanner for web applications)
  3. SQLMate (a friend of SQLMap with additional features)

These tools are ranked as the best alternatives to ZAP.

Alternatives (by score)

74

Arachni

Introduction

Arachni is framework written in Ruby with focus on evaluating the security of web applications. Typical users include security professionals and system administrators.

The tooling is free and open source. Besides Linux, it also runs on macOS and Microsoft Windows.

Project details

Arachni is written in Ruby.

Strengths and weaknesses

  • + More than 1000 GitHub stars
  • + The source code of this software is available

    Typical usage

    • Penetration testing
    • Security assessment
    • Web application analysis

    Arachni review

    64

    Yasuo

    Introduction

    Yasuo is a Ruby script that scans for vulnerable and exploitable third-party web applications. There are many remotely exploitable vulnerabilities for web applications and their front-end components. Yasuo helps to make it easier to scan for the weaknesses like remote code execution (RCE), SQL injections, and file inclusions.

    Project details

    Yasuo is written in Ruby.

    Strengths and weaknesses

    • + The source code of this software is available

      Typical usage

      • Penetration testing
      • Vulnerability scanning
      • Web application analysis

      Yasuo review

      64

      SQLMate

      Introduction

      SQLMate is a tool to perform security assessments and vulnerability of web applications. It can discover admin panels of websites, which might be a way to break into a web application. It also has the option for dorking, which means it can find possible vulnerable targets to a particular attack.

      Project details

      SQLMate is written in Python.

      Strengths and weaknesses

      • + The source code of this software is available
      • - No releases on GitHub available

      Typical usage

      • Penetration testing
      • Web application analysis

      SQLMate review

      60

      Wfuzz

      Introduction

      Wfuzz is a fuzzing tool written in Python. Tools like Wfuzz are typically used to test web applications and how they handle both expected as unexpected input.

      Project details

      Wfuzz is written in Python.

      Strengths and weaknesses

      • + More than 1000 GitHub stars
      • + The source code of this software is available

        Typical usage

        • Application fuzzing
        • Application security
        • Application testing
        • Web application analysis

        Wfuzz review

        64

        w3af

        Introduction

        W3af is an open source web application attack and audit framework and helps in scanning for vulnerabilities. The tool comes with both a graphical user interface (GUI) and command line utility. Some of the project files include a copyright line of 2006. That gives a good idea on the maturity of the project, and it is one of the rare tools that is still maintained after so many years.

        Project details

        w3af is written in Python.

        Strengths and weaknesses

        • + Tool is modular and extendable
        • + More than 2000 GitHub stars
        • + The source code of this software is available

          Typical usage

          • Application security
          • Application testing
          • Penetration testing
          • Vulnerability scanning
          • Web application analysis

          w3af review

          64

          CMSeeK

          Introduction

          CMSeeK is a security scanner for content management systems (CMS). It can perform a wide range of functions starting from the detection of the CMS, up to vulnerability scanning. The tool claims to support over 100 different CMS tools, with extensive support for the commonly used ones like Drupal, Joomla, and WordPress.

          The scans performed by CMSeeK include version detection. It can also do enumeration of users, plugins, and themes. This might be useful to see what users or components are available. The tool includes admin page discovery, file discovery, and directory listing. Anything that might be useful to a penetration test or security assessment, might be displayed.

          Project details

          CMSeeK is written in Python.

          Strengths and weaknesses

          • + The source code of this software is available
          • - Full name of author is unknown

          Typical usage

          • Penetration testing
          • Software exploitation
          • Software identification
          • Vulnerability scanning

          CMSeeK review

          74

          WordPress Exploit Framework (WPXF)

          Introduction

          WordPress is still one of the most popular frameworks for websites. A variety of open source tools exist to assess the security of this content management system, and its themes and plugins.

          Project details

          WordPress Exploit Framework is written in Ruby.

          Strengths and weaknesses

          • + More than 500 GitHub stars
          • + The source code of this software is available
          • - Has longer learning curve

          Typical usage

          • Penetration testing
          • Security assessment
          • Vulnerability scanning
          • Web application analysis

          WordPress Exploit Framework review

          60

          Wordstress

          Introduction

          WordPress is a popular choice among content management systems (CMS). Powering many websites and blogs, it is also a popular target. So regular updates and security testing can help to reduce the risk. WordStress can help with this testing.

          Project details

          Wordstress is written in Ruby.

          Strengths and weaknesses

          • + The source code of this software is available

            Typical usage

            • Application security
            • Vulnerability scanning
            • Web application analysis

            Wordstress review

            97

            Wapiti

            Introduction

            Wapiti is typically used to audit web applications.

            Project details

            Wapiti is written in Python.

            Strengths and weaknesses

            • + Project is mature (10+ years)
            • + The source code of this software is available
            • + Well-known tool

              Typical usage

              • Application fuzzing
              • Vulnerability scanning
              • Web application analysis

              Wapiti review

              74

              WhatWeb

              Introduction

              WhatWeb can be used stealthy and fast to determine what technologies are used on a particular website or web application. This process called fingerprinting can tell a lot about how it was build and possible weaknesses it might have. The tool can be used in different levels, from stealthy to very aggressive. This last one is useful in penetration tests or during development.

              Project details

              WhatWeb is written in Ruby.

              Strengths and weaknesses

              • + More than 25 contributors
              • + More than 1000 GitHub stars
              • + The source code of this software is available

                Typical usage

                • Reconnaissance
                • Web application analysis

                WhatWeb review

                78

                JoomScan

                Introduction

                JoomScan could be used to test your Joomla installation or during security assessments. As it has a primary focus on Joomla, it may provide better results than generic vulnerability scanners.

                Project details

                JoomScan is written in Perl.

                Strengths and weaknesses

                • + The source code of this software is available

                  Typical usage

                  • Vulnerability scanning
                  • Vulnerability testing

                  JoomScan review

                  97

                  django-security

                  Introduction

                  Django-security is an extension for developers seeking more security measures in their Django project. The toolkit can set or activate particular settings improving security. Examples of these settings include the use of particular HTTP headers that increase the security defenses of the web application.

                  Part of the toolkit is middleware to enforce password strength, set the do-not-track header, enable content security policy (CSP), enable privacy policy (P3P), limit session length, use HTTPS (HSTS), XSS protection, and more.

                  Project details

                  django-security is written in Python.

                  Strengths and weaknesses

                  • + More than 10 contributors
                  • + The source code of this software is available

                    Typical usage

                    • Application security

                    django-security review

                    81

                    Nikto

                    Introduction

                    Nikto helps with performing security scans against web servers and to search for vulnerabilities in web applications.

                    Project details

                    Nikto is written in Perl.

                    Strengths and weaknesses

                    • + The source code of this software is available
                    • + Well-known tool

                      Typical usage

                      • Penetration testing
                      • Security assessment
                      • Web application analysis

                      Nikto review

                      60

                      shcheck (Security Header Check)

                      Introduction

                      This simple tool is a good option to test if advised HTTP headers are available on web application and websites. It can be used as a defensive measure during development, or offensive to find weaknesses in existing applications.

                      Project details

                      shcheck is written in Python.

                      Strengths and weaknesses

                      • + Very low number of dependencies
                      • + The source code of this software is available
                      • - No releases on GitHub available

                      Typical usage

                      • Application security
                      • Web application analysis

                      shcheck review

                      60

                      wig (WebApp Information Gatherer)

                      Introduction

                      Wig is a security tool to discover what particular software is for a web application or website. It can detect several Content Management Systems (CMS) and other administrative applications. This may be useful for those performing reconnaissance or information gathering, like during a penetration test of security assessment.

                      Project details

                      wig is written in Python.

                      Strengths and weaknesses

                      • + The source code of this software is available
                      • - No updates for a while
                      • - Full name of author is unknown

                      Typical usage

                      • Application fingerprinting
                      • Information gathering
                      • Reconnaissance
                      • Web application analysis

                      wig review

                      60

                      XSSER

                      Introduction

                      XXSER helps to get from XSS to Remote Code Execution (RCE). It provides custom tools and payloads integrated with Metasploit's Meterpreter. The goal is to automate as much as possible.

                      Project details

                      XSSER is written in Python.

                      Strengths and weaknesses

                      • + The source code of this software is available
                      • - Minimal or no documentation available

                      Typical usage

                      • Penetration testing
                      • Security assessment
                      • Web application analysis

                      XSSER review

                      60

                      seespee

                      Introduction

                      Seespee helps to crawl a website and define a suitable Content Security Policy (CSP). The related Content-Security-Policy header can be added with the discovered value. This header defines what local and external resources can be loaded on a website.

                      Project details

                      seespee is written in JavaScript.

                      Strengths and weaknesses

                      • + The source code of this software is available

                        Typical usage

                        • Application security

                        seespee review

                        89

                        Commix

                        Introduction

                        Commix is short for COMMand Injection eXploiter.

                        Project details

                        Commix is written in Python.

                        Strengths and weaknesses

                        • + More than 10 contributors
                        • + More than 1000 GitHub stars
                        • + The source code of this software is available

                          Commix review

                          64

                          DorkNet

                          Introduction

                          DorkNet helps with the discovery of vulnerable web apps. It is a script written in Python that leverages Selenium.

                          Project details

                          DorkNet is written in Python.

                          Strengths and weaknesses

                          • + The source code of this software is available

                            Typical usage

                            • Security assessment
                            • Vulnerability scanning
                            • Web application analysis

                            DorkNet review

                            60

                            Jackhammer

                            Introduction

                            The tool uses RBAC (Role Based Access Control) with different levels of access. Jackhammer uses several tools to do dynamic and static code analysis (e.g. for Java, Ruby, Python, and Nodejs). It checks also for vulnerabilities in libraries. Due to its modular architecture, it can use several scanners out of the box, with options to add your own.

                            The Jackhammer project was initially added to GitHub on the 8th of May, 2017.

                            Project details

                            Jackhammer is written in Ruby.

                            Strengths and weaknesses

                            • + The source code of this software is available

                              Typical usage

                              • Collaboration
                              • Information sharing

                              Jackhammer review

                              64

                              Jawfish

                              Introduction

                              Jawfish is a security tool to test web applications. It can find related exploits and update according to an internal database.

                              Project details

                              Jawfish is written in Python.

                              Strengths and weaknesses

                              • + The source code of this software is available

                                Typical usage

                                • Penetration testing
                                • Security assessment
                                • Vulnerability scanning
                                • Web application analysis

                                Jawfish review

                                64

                                Susanoo

                                Introduction

                                Susanoo is a security tool to test the security of a REST API. With this focus, it goes beyond the typical attack surface of a web application.

                                Project details

                                Susanoo is written in Python.

                                Strengths and weaknesses

                                • + The source code of this software is available

                                  Typical usage

                                  • API testing
                                  • Application testing

                                  Susanoo review

                                  74

                                  ScanSSH

                                  Introduction

                                  ScanSSH is a security tool to perform scans on SSH to detect open proxies and available services. It retrieves version information and related details.

                                  Project details

                                  ScanSSH is written in C.

                                  Strengths and weaknesses

                                  • + Project is mature (10+ years)
                                  • + The source code of this software is available

                                    Typical usage

                                    • Information gathering
                                    • Reconnaissance

                                    ScanSSH review

                                    78

                                    PTF (The PenTesters Framework)

                                    Introduction

                                    PTF or the PenTesters Framework is a Python script to keep your penetration testing toolkit up-to-date. It is designed for distributions running Debian, Ubuntu, Arch Linux, or related clones. PTF will do the retrieval, compilation, and installation of the tools that you use. As it is a modular framework, you can use many of the common pentesting tools or add your own tools.

                                    Project details

                                    PTF is written in Python.

                                    Strengths and weaknesses

                                    • + More than 50 contributors
                                    • + Tool is easy to use
                                    • + More than 1000 GitHub stars
                                    • + The source code of this software is available

                                      Typical usage

                                      • Penetration testing
                                      • Security assessment
                                      • Software management
                                      • Software testing

                                      PTF review

                                      74

                                      Suhosin

                                      Introduction

                                      Suhosin is a security extension for PHP and consists of two parts that enhance PHP. It helps with protecting against known and unknown attacks.

                                      Project details

                                      Suhosin is written in C.

                                      Strengths and weaknesses

                                      • + The source code of this software is available
                                      • - Well-known tool

                                      Typical usage

                                      • Application security

                                      Suhosin review

                                      Some relevant tool missing as an alternative to ZAP? Please contact us with your suggestion.