The ZAP by Checkmarx Core project
Intercepting proxy, active and passive scanner and automation framework for web apps and APIs.
- Language
- Java
- Licence
- Apache-2.0
- Stars
- 16k
- Latest
- v2.17.0
- Last push
- 2026-10-06
alternatives to
Burp Suite
Web application security testing toolkit with an intercepting proxy and an automated scanner. A closed product from PortSwigger.
Side by side
| Tool | Fit | Stars | Licence | Terms | Self-hosted | Language | Latest | Last push |
|---|---|---|---|---|---|---|---|---|
| ZAP | Full replacement | 16k | Apache-2.0 | Open source | No | Java | v2.17.0 | 2026-10-06 |
| Nuclei | Partial | 32k | MIT | Open source | No | Go | v3.11.1 | 2026-10-06 |
Every alternative
2 alternatives
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
Template-driven scanning for known vulnerabilities and misconfigurations, without an intercepting proxy.
Head to head
About Burp Suite
- Vendor
- PortSwigger