Skip to content

Automating Suites

OWASP ZAP (Free, Open-Source)

BurpSuite

Comparision OWASP ZAP vs BurpSuite

Feature Burp Suite Community Edition OWASP ZAP Burp Suite Pro
Web Application Scanning Not Available Available with basic security vulnerabilities Available with quality security vulnerabilities
Intercepting Feature Available Available Available
Fuzzing Capabilities Available Available Available
Encoder and Decoder Available Not Available Available
Cost Free Free Paid Subscription - Advanced Functionality ($399 per year)
Documentation Extensive documentation available Little documentation available Extensive documentation available
Spider Available Available Available
Updates Available Available Available
Extensions Less Options Available No provision for enhance functionality Available
Coverage Medium coverage Less coverage Extensive Coverage
False Positive Less More Less
Session Token Entropy Analysis Available Not Available Available
Comparison Feature Available Not Available Available

Credits: https://allabouttesting.org/burp-suite-vs-owasp-zap-which-is-better/

Attacking modes

  1. Sniper - The most popular attack type, this cycles through our selected positions, putting the next available payload (item from our wordlist) in each position in turn. This uses only one set of payloads (one wordlist).

  2. Battering Ram - Similar to Sniper, Battering Ram uses only one set of payloads. Unlike Sniper, Battering Ram puts every payload into every selected position. Think about how a battering ram makes contact across a large surface with a single surface, hence the name battering ram for this attack type.

  3. Pitchfork - The Pitchfork attack type allows us to use multiple payload sets (one per position selected) and iterate through both payload sets simultaneously. For example, if we selected two positions (say a username field and a password field), we can provide a username and password payload list. Intruder will then cycle through the combinations of usernames and passwords, resulting in a total number of combinations equalling the smallest payload set provided.

  4. Cluster Bomb - The Cluster Bomb attack type allows us to use multiple payload sets (one per position selected) and iterate through all combinations of the payload lists we provide. For example, if we selected two positions (say a username field and a password field), we can provide a username and password payload list. Intruder will then cycle through the combinations of usernames and passwords, resulting in a total number of combinations equalling usernames x passwords. Do note, this can get pretty lengthy if you are using the community edition of Burp.