Image: GitHub
Why it mattersA junior security tester handed a Burp Suite seat is working with a tool whose Repeater and Intruder cost money, and now has a free workspace that uses the same scanner the paid product tested their first finding against.
Testing a web application for flaws usually means paying for Burp Suite, whose Professional edition is listed at $499 per user on PortSwigger's own pricing page. OpenTRAP, a new project pushed to GitHub, offers a free workspace that reads and replays requests the same way. It reached 102 stars in the day since its first commit.
The project is published under AGPL-3.0 by an organisation called opentrap on GitHub. No named author appears in the repository. Its README calls itself "a free, open-source alternative to Burp Suite" and ships one file: a self-contained Linux AppImage that runs without an install step.
What is in the window
The README lists ten panels in the main view: Dashboard, Target, Proxy, Passive, Logger, Intruder, Repeater, Collaborator, Sequencer, Decoder and Comparer. The names match the ones a Burp Suite user already types into. Repeater holds a single request and lets the tester change and resend it. Intruder sends many altered requests through one template. Collaborator catches requests from a target that only answers over the network, which is how a blind flaw is detected.
The scan engine is OWASP ZAP, the long-running free scanner from the OWASP project. The README says so directly: "OpenTRAP uses the OWASP ZAP engine for crawling and scanning, and puts a familiar, Burp-style interface and workflow on top of it." A tester who already trusts ZAP's findings keeps those findings, and gets a workspace built around proxy-first manual testing on top.
Who it is for, in the README's own words
The README is specific about its reader: a tester who trusts ZAP's detection but prefers a proxy-first workspace. The project describes itself as "that front end" for that person. The HTTP history, the target site map and scope, and the full traffic logger are listed in the FAQ as living in one window alongside Repeater, Intruder and Collaborator. One window therefore holds the manual tools and the free detection engine together. A tester who already prefers ZAP's own window keeps using ZAP; the project calls itself a workspace built on top of ZAP for the people who find ZAP's window hard to work in.
What it does not run on
Three limits in the README, each worth checking before an install. The build ships only as a Linux AppImage, with no macOS or Windows build mentioned. The project names no individual maintainer in its README, which matters for a security tool the user is about to point at live traffic. And on the question of whether the headline features are reserved for a future paid edition, the README states that every feature is open and licensed under AGPL-3.0.
For a security team paying for Burp Suite Professional seats, the practical question is whether the Repeater and Intruder on top of ZAP cover the work the paid tool covers for the junior tester. The AppImage is a single download from the releases page.
Source
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.
