OWASP ZAP
7.6#1 in web application security scannersFree planFree planAPIExtensionLinuxmacOS
VisitOWASP ZAP vs Wapiti
Wapiti
6.6#7 in dynamic application security testing softwareFree planFree planLinuxmacOSSelf-hostedWindows
VisitWhat both publish
| Fact | OWASP ZAP | Wapiti |
|---|---|---|
| Authentication | Authentication features include browser-based, script-based, header-based and OAuth2 methods through the Authentication Helper add-on. | Wapiti supports Basic, Digest, and NTLM HTTP authentication, login forms, browser cookie import, and custom Python authentication scripts. |
| Purpose | ZAP is a web application scanner and proxy for security testing. | Wapiti audits websites and web applications with black-box scans that crawl deployed pages and test scripts and forms with payloads. |
OWASP ZAP plans
- Free / open sourceFree
- ZAPFree
Wapiti plans
- WapitiFree
Pick OWASP ZAP if…
ZAP is intended for developers, testers new to security testing, and security testing specialists. Its automation and Docker options also suit teams incorporating scans into CI workflows.
Pick Wapiti if…
Wapiti suits website and web application operators who want to run vulnerability scans in their own environment. It is a command-line tool for users able to install and operate it with a supported Python version.