ZAP (Zed Attack Proxy)
Ranked 5 of 5 pentest tools by recommenders
Free, open-source security testing proxy that people rank alongside Burp Suite; it takes effort to learn, and one critic found it unintuitive.
Free, open-source security testing proxy that people rank alongside Burp Suite; it takes effort to learn, and one critic found it unintuitive.
6 people gave an opinion
- recommend it
- 5
- criticize it
- 1
- approval share
- 83%
Recommended in 5 of 13 months
- November 2025: not recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: not recommended
- March 2026: not recommended
- April 2026: not recommended
- May 2026: not recommended
- June 2026: recommended
- July 2026: recommended
- August 2026: recommended
- September 2026: not recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 5 people recommend itNeeds 10 or more, not met.
- 5 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 5 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Useful for security testing
“ZAP, Burp, Nessus, SQLMap, etc. are likely also impressive if you put a little effort into learning how to use them”
Comment from 13 Jun 2026 in “We've suspended access to Claude Mythos 5 and Claude Fable 5” “aids in driving through security testing”
Comment from 11 Aug 2026 in “Ask HN: How do you go from writing code to deploying with agents?” “contrary to my beloved burp/zap”
Comment from 20 Dec 2025 in “Charles Proxy”
Other pentest tools people recommend
The four most recommended other pentest tools, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| Burp Suite | 9 | 1 | 90% | 6 | — | — |
| Strix | 9 | 6 | 60% | 4 | — | — |
| Deadend CLI | 6 | 0 | 100% | 1 | — | — |
| SmokedMeat | 6 | 0 | 100% | 1 | — | — |
| ZAP (Zed Attack Proxy)This page | 5 | 1 | 83% | 5 | — | — |
What people said
All 7 comments that mention it, newest first. Each links to the original comment.
“aids in driving through security testing”
“Viper and zap combined are more than 20,000 lines of code (according to cloc) that I don't need to read or understand how they work”
“ZAP, Burp, Nessus, SQLMap, etc. are likely also impressive if you put a little effort into learning how to use them”
“Surprisingly fun for how simple it is”
“contrary to my beloved burp/zap”
“found it really unintuitive to use”
“entirely free and Open Source”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.