OWASP ZAP
ZAP (Zed Attack Proxy) is the open-source equivalent of Burp Suite — an intercepting proxy and web application security scanner maintained by the OWASP project. It runs on any platform with Java, ships by default in Kali Linux, and covers the same core workflow: proxy → spider → scan → fuzz → report.
Burp Suite ↔ ZAP equivalency
| Burp Suite | OWASP ZAP |
|---|---|
| Site Map | Site Tree |
| HTTP History | History |
| Scope | Context |
| Interceptor | Break |
| Repeater | Request Editor |
| Intruder | Fuzzer |
| Spider | Spider |
| Scanner | Active Scan |
| BApp Store | Add On Marketplace |
The workflow is the same — configure scope, proxy traffic through the tool, spider for content discovery, then actively scan for vulnerabilities. The interface differs significantly, but the mental model transfers directly.
ZAP’s built-in browser
On Kali Linux, ZAP can launch a pre-configured Firefox session via web automation — no manual proxy or certificate setup needed. Like Burp’s built-in browser, this keeps assessment traffic isolated. One advantage over Burp: ZAP’s browser automatically passes session cookies back to ZAP for authenticated scanning. One disadvantage: the user-agent string is less generic than Burp’s, making it potentially easier to fingerprint.
Automated scans
The Quick Start tab offers one-click automated scanning:
- Traditional spider: follows HTML links and forms
- AJAX spider: uses a headless browser to crawl JavaScript-heavy applications
Path enumeration (Forced Browse)
ZAP’s Forced Browse is functionally equivalent to gobuster — directory/file brute-forcing against a target. Configure the wordlist in Tools > Options > Forced Browse, then right-click the target site and choose Attack > Forced Browse Site.
Sources
Related: burp-suite, burp-suite-firefox, burp-suite-aws-cli-proxy, xss-attacks