17.6
OWASP ZAP, now identified as ZAP or ZAP by Checkmarx, is a free, open-source web application scanner and proxy for security testing.
Free planOpen sourceAPIExtensionLinux
Alternatives to Wapiti
Wapiti is a free, self-hosted Python scanner for auditing deployed websites and web applications. It crawls links, forms, and scripts, then sends payloads without inspecting source code. Its checks include SQL and XPath injection, XSS, file disclosure, command execution, XXE, SSRF, and open redirects. It also scans REST APIs from OpenAPI files, supports several authentication methods, handles proxies and scan limits, resumes through SQLite sessions, crawls JavaScript, and…
26.9
Beagle Security is an agentic AI penetration testing platform for web applications, APIs, and GraphQL.
Free planWebAPI
36.8
ImmuniWeb is a cybersecurity platform for testing and protecting web and mobile applications, APIs, microservices, and cloud and network infrastructure.
AndroidiOSWeb
- 4
Nuclei
Nuclei is a free, open-source vulnerability scanner for applications, infrastructure, cloud platforms, and networks.
Free planLinuxmacOSSelf-hostedWindows6.8Free plan - 5
ZeroThreat
ZeroThreat is an AI-powered penetration-testing platform for web applications and APIs, available through web and API access.
Free planWebAPI6.7From $100 a month - 6
VAddy
VAddy is a cloud service for automated black-box security testing of web applications.
WebAPILinuxmacOS6.6From ¥19,800 a month - 7
Astra Security
Astra Security describes its product as a continuous penetration testing platform for web applications, APIs, and cloud infrastructure.
WebAPI6.5From $699 a year - 8
Burp Suite DAST
Burp Suite DAST is an automated dynamic web vulnerability scanner built on the scanning engine used in Burp Suite Professional.
WebAPILinuxSelf-hosted6.4 - 9
Invicti
Invicti is an application security platform for finding, prioritizing, and fixing application risk.
WebAPISelf-hosted6.3$500 one-time - 10
Blacklock
Blacklock is a cloud Penetration Testing as a Service platform available through a web interface, API, and browser extension.
WebAPIExtension6.1From $85 a month - 116.1From $10 a month
- 12
BlueClosure BC Detect
BlueClosure BC Detect is a paid JavaScript security platform presented for IT security professionals.
5.9From £60 a month - 13
BreachLock DAST
BreachLock DAST checks running applications from the outside by sending inputs and analyzing their responses.
WebAPIExtension5.9From $5,000 a year - 14
Haxore Web Security Scanner
WebExtension5.9From $49 a month - 15
HCL AppScan Source
HCL AppScan Source is a static application security testing tool that analyzes source code for vulnerabilities early in the development lifecycle.
LinuxSelf-hostedWindows5.7 - 16
AppCheck
AppCheck automates security-flaw discovery across websites, applications, networks, and cloud infrastructure.
WebAPISelf-hosted5.6 - 17
Vega
Vega is a free, Java-based graphical platform for testing web application security.
LinuxmacOSWindows5.6 - 18
Escape
Escape is an offensive security platform that brings together attack surface management, business-logic-aware dynamic application security testing…
WebAPI5.5 - 19
Rapid7 InsightAppSec
WebWindows5.5From $175 a month - 20
Tenable One Web App Scanning
Tenable One Web App Scanning is a web application scanning product from Tenable, a company founded in 2002 and headquartered in Columbia, Maryland, United States.
Web5.5From $3,578 a year - 21
5.4 - 22
OpenText Fortify DAST
OpenText Fortify DAST is a paid application security testing product for Linux and web platforms.
WebLinux4.9 - 23
Pentest-Tools Website Scanner
WebLinuxmacOS4.9 - 244.8
- 254.8
- 26
FortiDAST
Web4.7 - 274.7
- 284.3