17.6
OWASP ZAP, now identified as ZAP or ZAP by Checkmarx, is a free, open-source web application scanner and proxy for security testing.
Free planOpen sourceAPIExtensionLinux
Alternatives to Wapiti
Wapiti is a free, open-source command-line scanner for auditing websites and web applications. It crawls pages, tests scripts and forms with injected payloads, and covers issues such as SQL injection, XSS, command execution, SSRF, and file disclosure. It can scan authenticated areas and REST APIs from OpenAPI files, and produces reports in formats including HTML, JSON, CSV, and Markdown. Linux, macOS, Windows, and self-hosted deployments are supported, with installation…
27.3
Free planWebAPI
36.9
Beagle Security is an agentic AI penetration testing platform for web applications, APIs, and GraphQL.
Free planWebAPI
- 4
StackHawk HawkScan
StackHawk HawkScan is a dynamic application security testing scanner for web applications and APIs.
WebAPILinuxmacOS6.8From $10 a month - 5
w3af
w3af is a free, open-source web application security scanner for developers and penetration testers assessing web vulnerabilities.
Free planWebAPILinuxmacOS6.8Free plan - 6
Indusface WAS
Indusface WAS is a cloud-based web application security scanner using dynamic application security testing to identify vulnerabilities.
Web6.6From $599 a year - 7
Bright Security DAST
Bright Security DAST is a dynamic application security testing tool offered as SaaS.
WebAPILinuxmacOS6.5 - 8
Burp Suite DAST
Burp Suite DAST is an automated dynamic web vulnerability scanner built on the scanning engine used in Burp Suite Professional.
WebAPILinuxSelf-hosted6.4 - 9
Astra DAST Scanner
WebAPI6.3From $699 a year - 10
Invicti
Invicti is an application security platform for finding, prioritizing, and fixing application risk.
WebAPISelf-hosted6.3$500 one-time - 11
Veracode DAST
Veracode DAST is a dynamic application security testing tool that scans live web applications and REST APIs.
WebAPILinuxmacOS6.2 - 12
Offensive360 DAST
Offensive360 DAST dynamically tests live web applications and APIs with a headless browser, more than 40 active exploit checks, and 19 passive analyzers.
WebAPISelf-hosted5.9 - 13
Checkmarx DAST
Checkmarx DAST tests live web applications and APIs by simulating real-world attacks.
WebAPILinuxmacOS5.8 - 14
Safeguard DAST
Safeguard DAST is web-based security software with authenticated scanning, API testing, and CI/CD integration.
WebSelf-hosted5.8 - 15
HCL AppScan Source
HCL AppScan Source is a static application security testing tool that analyzes source code for vulnerabilities early in the development lifecycle.
LinuxSelf-hostedWindows5.7 - 16
SecuDAST
SecuDAST is a self-hosted dynamic application security testing tool for running applications inside an organization’s network.
APILinuxSelf-hosted5.6 - 17
Rapid7 InsightAppSec
WebWindows5.5From $175 a month - 18
Tenable One Web App Scanning
Tenable One Web App Scanning is a web application scanning product from Tenable, a company founded in 2002 and headquartered in Columbia, Maryland, United States.
Web5.5From $3,578 a year - 19
Black Duck Continuous Dynamic
Black Duck Continuous Dynamic is a cloud-based SaaS service for dynamic security testing of web applications in QA and production.
WebAPI5.3 - 20
OpenText Fortify DAST
OpenText Fortify DAST is a paid application security testing product for Linux and web platforms.
WebLinux4.9 - 214.8
- 224.8
- 234.8
- 24
FortiDAST
Web4.7 - 254.7