I am new to security testing and I'm confused about two web proxy tools, namely Burp and OWASP ZAP.

Both seem to fulfill the same task, so what exactly are the differences between them?

  • This is opinion based question and off topic.Both are good imo – Vipul Nair Aug 19 '19 at 9:18
  • 2
    I edited the question to be less opinion-based. – MechMK1 Aug 19 '19 at 13:39

It is true that both tools are in the same space. Burp is a commercial closed source tool (which can be extended) developed by a commercial company while ZAP is a free open source tool developed by the community.

Both have relative strengths and weaknesses, but as the ZAP project lead I'll let others enumerate those as I'm kind of biased.

Having 2 tools with overlapping functionality is (in my opinion) a good thing, and many security people chain ZAP and burp together to get the advantages of both.

  • 1
    Can you add what the differences are? Feature sets can be looked up in the documentation, but could you add your unique insights? – schroeder Aug 20 '19 at 7:42
  • Well, I happen to think that being free and open source are significant differences :) I'd say that some of ZAP's strengths are: scripting, the API, the Heads Up Display(HUD). Documentation is a weakness ;) I'm probably not the best person to enumerate Burp's strengths, but it is a very popular and well regarded tool. – Simon Bennetts Aug 20 '19 at 11:05
  • 1
    Burp Pro is definetly the go-to tool because of the variety of plugins you get, which are not available for ZAP, meaning you would have to script them on your own. Otherwise there is not much of a difference. – Raimonds Liepiņš Aug 21 '19 at 5:51
  • @SimonBennetts Do you have any tips on where to find good zap learning resources? I found the video tutorials on your youtube channel, but they are from 2015. Are they still relevant? – vhflat Nov 7 '19 at 11:26
  • Mostly yes, but they will be a bit out of date. We have lots of links off github.com/zaproxy/zaproxy but the good news is that we are finally working on some new ZAP videos :) Follow either myself (@psiinon) or @zaproxy on twitter to see when they go live, or join the ZAP user or developer groups. – Simon Bennetts Nov 8 '19 at 10:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.