Burp Suite vs ZAP: Finally made the switch after 4 years

I used Burp Suite for like 4 years straight, thought it was the only real option for web app testing. But last month I had to do a quick scan on a client's site and my Burp license had expired, so I fired up ZAP instead. Honestly, I was shocked at how good the automated scanning is now - it found 3 SQLi issues that Burp missed in a previous test. The community scripts are also way easier to plug in (just drag and drop), which saved me an hour of fiddling with extensions. I still miss Burp's repeater for manual work, but for day-to-day scanning I'm starting to think ZAP is actually better. Has anyone else tried both and found a clear winner for specific tasks?

1 comments

1 Comment

gavin_hill271mo ago

ZAP's automated scanning got a lot better in the last couple versions, but Burp's repeater is still way better for manual work. The drag and drop scripts thing is nice though, saves a ton of time compared to messing with extensions.