The best open source alternative to Burp Suite is mitmproxy. If that doesn't suit you, our users have ranked more than 25 alternatives to Burp Suite and 12 is open source so hopefully you can find a suitable replacement. Other interesting open source alternatives to Burp Suite are HTTP Toolkit, SiteOne Crawler, Zed Attack Proxy (ZAP) and nuclei.
mitmproxy is an SSL-capable man-in-the-middle proxy for HTTP. It provides a console interface that allows traffic flows to be inspected and edited on the fly. It also features mitmdump, a commandline tool that provides a tcpdump-like interface for saving, viewing and...
HTTP Toolkit is a beautiful, cross-platform & open-source HTTP(S) debugging proxy, analyzer & client, with built-in support for modern tools and automatic interception for clients from Docker to Android to iOS.
Spain
EU
A free in-depth website analyzer providing audits of security, performance, SEO, accessibility and other technical aspects. Available as a desktop application for Windows/macOS/Linux and as a CLI tool for advanced users and CI/CD processes. It also includes an offline web page exporter.
CzechiaEU
The Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications.
Nuclei is used to send requests across targets based on a template, leading to zero false positives and providing fast scanning on a large number of hosts. Nuclei offers scanning for a variety of protocols, including TCP, DNS, HTTP, SSL, File, Whois, Websocket, Headless etc.
United States
United States
Open-source native macOS HTTP debugging proxy — intercept HTTPS, inspect APIs, mock responses, debug WebSocket & GraphQL. Community-driven. For developers, by developers.
Lonkero is a high-performance web vulnerability scanner built in Rust for penetration testers and bug bounty hunters who are tired of slow, bloated tools that generate hundreds of false positives.
FinlandEU
Firefox add-on that lets you change headers and request parameters before they're sent to the server. Unlike proxy request modifiers, it's integrated into the browser, so it has no problem with HTTPS connections, client authentication certificates, or other features that...
United Kingdom
HunterX is an open-source, AI-assisted vulnerability scanner and red team framework designed to automate and orchestrate modern security testing workflows.
Egypt
Easy, intuitive yet powerful HTTP(S) debugging proxy for macOS, Windows and Linux — capture, inspect, mock, break and replay traffic.
GermanyEU
Xalgorix is an Apache-2.0 open-source autonomous AI pentester for web applications and source repositories. It runs a structured 22-phase methodology, orchestrates security tools and browser-assisted testing, then sends candidate findings to an independent verifier that attempts...
India
