3 ms·

There's been an open source option for 10 years - ZAP :)

• bittencourtVFX 6y ago
  But seriously, have you ever tried zap against burp? Like all owasp projects, the idea is awesome and there is an excellent community behind it but the execution stopped being anything useful years ago. I really think owasp and ‘free’ are what gives zap it’s base. But a base isn’t the same as relevant. Burp is with all it’s faults is still so much better in every aspect. If you just discard any technical feature, just the workflow from start to finish shows zap being build BY developers and burp being build FOR hackers. This alone explains why every serious security professional you will ever meet will swear to burp. This doesn’t mean that there is no usecase of course. It’s probably still relevant in the training area and it is included as an ‘automated’ dast/scanner in many cicd pipelines for cheap and preventing low-hanging fruit. Hetty looks promising so far and competition will drive the overall quality of this niche.