Zaproxy - An easy to use integrated penetration testing tool for finding vulnerabilities

  •        1367

The OWASP Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing as well as being a useful addition to an experienced pen testers toolbox.

Its functionality include Intercepting Proxy, Automated scanner, Forced browsing, Dynamic SSL certificates and lot more.

https://github.com/zaproxy/zaproxy
https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project
http://code.google.com/p/zaproxy

Tags
Implementation
License
Platform

   




Related Projects

Beef - Browser Exploitation Framework


BeEF is short for The Browser Exploitation Framework. It is a penetration testing tool that focuses on the web browser. BeEF allows the professional penetration tester to assess the actual security posture of a target environment by using client-side attack vectors. Unlike other security frameworks, BeEF looks past the hardened network perimeter and client system, and examines exploitability within the context of the one open door: the web browser.

Nogotofail - Network Security Testing Tool


Nogotofail is a network security testing tool designed to help developers and security researchers spot and fix weak TLS/SSL connections and sensitive cleartext traffic on devices and applications in a flexible, scalable, powerful way. It includes testing for common SSL certificate verification issues, HTTPS and TLS/SSL library bugs, SSL and STARTTLS stripping issues, cleartext issues, and more.

Sqlmap - Automatic SQL injection and database takeover tool


sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.

Metasploit Framework - World's most used penetration testing software


Metasploit, helps verify vulnerabilities and manage security assessments. It makes it easy to automate all phases of a penetration test, from choosing the right exploits to streamlining evidence collection and reporting.

IronWASP - Iron Web application Advanced Security testing Platform


IronWASP (Iron Web application Advanced Security testing Platform) is an open source system for web application vulnerability testing. It is designed to be customizable to the extent where users can create their own custom security scanners using it. Though an advanced user with Python/Ruby scripting expertise would be able to make full use of the platform, a lot of the tool's features are simple enough to be used by absolute beginners.



Watcher: Web security testing tool and passive vulnerability scanner


A Fiddler plugin that passively checks web application's for a variety of security issues. Watcher acts as assistant to the web developer, tester, or security auditor, by quickly identifying real issues and hot-spots that commonly lead to security problems in web apps.

Mongoaudit - A powerful MongoDB auditing and pentesting tool


Mongoaudit not only detects mis-configurations, known vulnerabilities and bugs but also gives you advice on how to fix them, recommends best practices and teaches you how to DevOp like a pro! There are quite a few holes in its default configuration settings. This fact, combined with abundant lazy system administrators and developers, led to what the press has called the MongoDB apocalypse.

PyLoris - Vulnerability test for DOS attack


PyLoris is a scriptable tool for testing a server's vulnerability to connection exhaustion denial of service (DoS) attacks. PyLoris can utilize SOCKS proxies and SSL connections, and can target protocols such as HTTP, FTP, SMTP, IMAP, and Telnet.

Benchmark


The OWASP Benchmark Project is a Java test suite designed to verify the speed and accuracy of vulnerability detection tools. The initial version is intended to support Static Analysis Security Testing Tools (SAST). A future release will support Dynamic Analysis Security Testing Tools (DAST), like OWASP ZAP, and Interactive Analysis Security Testing Tools (IAST). The goal is that this test application is fully runnable and all the vulnerabilities are actually exploitable so its a fair test for an

Hardanger - Web Application Penetration Testing Platform


Hardanger is an open source web application penetration testing platform for Microsoft Windows operating systems.

LoverBoy


A web application penetration testing tool that can extract data from SQL Server, MySQL, DB2, Oracle, Sybase, Informix, and Postgres. Further, it can crawl a website as a vulnerability scanner looking for sql injection vulnerabilities.

OWASP-Xenotix-XSS-Exploit-Framework


OWASP Xenotix XSS Exploit Framework is an advanced Cross Site Scripting (XSS) vulnerability detection and exploitation framework. It provides Zero False Positive scan results with its unique Triple Browser Engine (Trident, WebKit, and Gecko) embedded scanner. It is claimed to have the world’s 2nd largest XSS Payloads of about 1500+ distinctive XSS Payloads for effective XSS vulnerability detection and WAF Bypass. It is incorporated with a feature rich Information Gathering module for target Reco

minion-zap-plugin - Minion ZAP Plugin


This is a plugin for Minion that executes the OWASP Zed Attack Proxy (ZAP) penetration testing tool. This tool is designed to find vulnerabilities in web applications.Interested in learning more about ZAP? See zaproxy.

SPIPScan - SPIP (CMS) Scanner for penetration testing purpose written in Python


SPIP (CMS) Scanner for penetration testing purpose written in Python, and released under MIT License.

webvulnscan - A web application vulnerability scanner intended for automatic testing


A web application vulnerability scanner intended for automatic testing

A free penetration testing toolkit


Inguma is a free penetration testing and vulnerability discovery toolkit entirely written in python. Framework includes modules to discover hosts, gather information about, fuzz targets, brute force usernames and passwords, exploits, and a disassembl

mitmproxy - Intercept HTTP traffic for penetration testing


mitmproxy is an interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers. mitmproxy is an interactive, SSL-capable intercepting proxy with a console interface. mitmdump is the command-line version of mitmproxy. Think tcpdump for HTTP. mitmweb is a web-based interface for mitmproxy.

scanner-tests - A messy collection of PHP files for testing Web vulnerability scanners.


A messy collection of PHP files for testing Web vulnerability scanners.

metasploit - The Metasploit Framework - a powerful tool for penetration testing


The Metasploit Framework - a powerful tool for penetration testing

AWSome - A tool for penetration testing AWS EC2 configurations.


A tool for penetration testing AWS EC2 configurations.