ZAP
by Checkmarx
Open-source web application security scanner and intercepting proxy
Visit zaproxy.org FreeOpen source
ZAP (Zed Attack Proxy) is a widely used web app security testing tool. It acts as an intercepting proxy for manual testing and offers automated active and passive scanning, scripting, and CI-friendly automation.
Key features
- Intercepting proxy for manual testing
- Automated passive and active scans
- Automation framework for CI
- Extensible with add-ons
Similar tools
CodeQL
GitHub's semantic code analysis engine for finding vulnerabilities
OSV-Scanner
Scan dependencies for known vulnerabilities using the OSV.dev database
Semgrep
Lightweight static analysis for finding bugs and enforcing code standards
Trivy
Find vulnerabilities, misconfigurations, and secrets in containers and code
TruffleHog
Find and verify leaked credentials in code, history, and cloud storage
