11

I am new to security testing and I'm confused about two web proxy tools, namely Burp and OWASP ZAP.

Both seem to fulfill the same task, so what exactly are the differences between them?

2
  • This is opinion based question and off topic.Both are good imo – yeah_well Aug 19 '19 at 9:18
  • 2
    I edited the question to be less opinion-based. – MechMK1 Aug 19 '19 at 13:39
13

It is true that both tools are in the same space. Burp is a commercial closed source tool (which can be extended) developed by a commercial company while ZAP is a free open source tool developed by the community.

Both have relative strengths and weaknesses, but as the ZAP project lead I'll let others enumerate those as I'm kind of biased.

Having 2 tools with overlapping functionality is (in my opinion) a good thing, and many security people chain ZAP and burp together to get the advantages of both.

7
  • 1
    Can you add what the differences are? Feature sets can be looked up in the documentation, but could you add your unique insights? – schroeder Aug 20 '19 at 7:42
  • Well, I happen to think that being free and open source are significant differences :) I'd say that some of ZAP's strengths are: scripting, the API, the Heads Up Display(HUD). Documentation is a weakness ;) I'm probably not the best person to enumerate Burp's strengths, but it is a very popular and well regarded tool. – Simon Bennetts Aug 20 '19 at 11:05
  • 1
    Burp Pro is definetly the go-to tool because of the variety of plugins you get, which are not available for ZAP, meaning you would have to script them on your own. Otherwise there is not much of a difference. – Raimonds Liepiņš Aug 21 '19 at 5:51
  • @SimonBennetts Do you have any tips on where to find good zap learning resources? I found the video tutorials on your youtube channel, but they are from 2015. Are they still relevant? – vhflat Nov 7 '19 at 11:26
  • 1
    @SimonBennetts Video series is very helpful. – Nitin Rastogi Jul 2 '20 at 15:28
2

I feel like this might largely be a question of UI preference, as I haven't found something I did in BurpCE that I really can't do in ZAP, and I would say that ZAP is more intuitive. Also, the tabs in Burp are super annoying, and can get unmanageable when you start to have a ton. There are definitely some rough patches in ZAP where doing something looks to be possible, but its just easier in Burp. I do find myself in ZAP more than BurpCE after really getting used to ZAP.

That being said, it seems like Burp's paid feature set is much more of a "Web Application Scanner", which devs can leave running somewhere and just let it scan and flag stuff, as opposed to ZAP, being a tool for web app vuln testing that has to actively be used by the end user.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.