---

The most capable intercepting proxies, such as Burp Suite, are commercial and closed, with their most useful features behind a paid licence. OWASP ZAP is a powerful open engine, but its interface is unfamiliar to the many testers who work proxy-first. OpenTRAP brings the two together: the familiar Burp-style workflow on top of the trusted OWASP ZAP detection engine, genuinely open, genuinely useful day to day, and immediately familiar to anyone who has worked with an intercepting proxy before.

OpenTRAP is that tool. A complete testing workspace with a clean, recognisable workflow, that any practitioner can run, inspect, and extend, with no licence gate on its core capabilities. It is built to be improved by the people who use it rather than steered by a single vendor's roadmap. If a security tester can describe a better way to work, OpenTRAP should be the tool that lets them build it.

What it is

A proxy-first workspace for web application testing. Capture, inspect, replay and tamper with the traffic between a browser and a web application. Map an application's attack surface, and drive repeatable manual and automated testing from one window: interception, HTTP history, a target site map and scope, a request toolset, an out-of-band collaborator, and a complete log of everything that runs.

It is built for penetration testers, bug bounty hunters, AppSec engineers and students who want a professional intercepting-proxy workflow without a commercial licence.

See it in action

Target Site map, scope and every issue found, with the advisory, request and response beside it.	Proxy and built-in browser One click opens Chromium already routed through the proxy and trusting its certificate authority, so TLS interception works with nothing to configure.
Collaborator Out-of-band DNS and HTTP interactions captured for blind vulnerabilities, with every callback request on record.	Intruder Four attack types with payload sets and processing; the live attack table shows status, length and timing per request.
Repeater Edit and reissue a request, one numbered tab at a time, with the full response beside it.	Logger A complete, filterable record of every request OpenTRAP and the scan engine make.
Decoder Chain URL, Base64, hex and hash transforms on any value, or let smart decode work it out for you.	About The build, the scan engine in use and where it comes from, the runtime and the licence, stated plainly.

Full-size screenshots of every tool are on the project site.

Help build OpenTRAP

OpenTRAP is a community project, and this is an open call. We want this to grow into something the whole web security community owns and improves. If you can fix a bug, patch a rough edge, sharpen the UI, add a tool, or bring anything useful at all, we want your contribution. You do not need permission to improve it: if you think you can make it better, you probably can.

• Every change is reviewed, merged, and fully credited to its author.
• One-line fixes are as welcome as whole new tools.
• Bug reports and concrete ideas move the project forward too.

The fastest way to help it grow is to star the repository and share it (buttons at the top), and to send that first change. See CONTRIBUTING.md to get started, then open an issue or a pull request.

Scanning and detection

Point OpenTRAP at a target and it crawls the application, maps what it finds, and audits it for real vulnerabilities: injection, cross-site scripting, broken access control, information disclosure, misconfiguration and more. Findings land in a clear issue view with the request, response and the matched evidence highlighted, ready to triage or hand straight to a developer. The detection is built on the proven OWASP ZAP engine, so what OpenTRAP reports holds up.

Highlights

• Proxy-first by design - intercept, replay and edit live traffic, with the whole toolset one click away.
• Detection that stands up - crawl and audit with the proven OWASP ZAP engine, so the findings you report carry weight.
• Everything in one window - repeater, intruder, sequencer, decoder, comparer, collaborator and a full logger.
• One self-contained file - every release is a single Linux AppImage with its own runtime and the scan engine built in; download it and run it.
• Open and hackable - AGPL v3.0: read it, change it, extend it, with no gate on its core capabilities.
• Built to be improved - shaped by the people who use it, with every contribution credited.

The toolset

Tool	What it does
Dashboard	Live tasks, issues and event log; start a scan
Target	Site map tree and the suite-wide scope that governs every tool
Proxy	Intercept, HTTP history, per-host certificate authority
Passive	Configure the scan engine's rules (enable, disable, threshold)
Logger	A complete record of every request OpenTRAP and the engine make
Intruder	Four attack types with payload sets and processing
Repeater	Edit and reissue a request, one numbered tab at a time
Collaborator	Out-of-band interaction capture for blind vulnerabilities
Sequencer	Token randomness analysis with entropy tests
Decoder / Comparer	Chained encode/decode/hash transforms, and item diffs

Right-click any request or response to send it between tools.

Get started

Download the latest release from the releases page and run it. Nothing to install.

One file: the AppImage. It bundles its own Java runtime and the scan engine, so there is no Java to install. This link always points at the latest release: opentrap-x86_64.appimage

Or from a terminal, fetch it:

wget https://github.com/opentrap/opentrap/releases/latest/download/opentrap-x86_64.appimage

make it executable:

chmod +x opentrap-x86_64.appimage

and run it:

./opentrap-x86_64.appimage

You can also double-click the downloaded file in your file manager.

The download is complete: the Java runtime and the scan engine are inside the file and set themselves up on first use. Every release is this one AppImage, so nothing ships with parts missing. The optional testing browser is an in-app download, offered only when you want it, so the release stays small.

The fastest way to test a target is the built-in browser: on the Proxy tab click open browser. It launches a bundled Chromium in an isolated profile, already routed through the proxy and already trusting OpenTRAP's certificate authority, so there is nothing to configure and no certificate to install.

Build from source

./build.sh      # compile src/ into a lean dev jar (uses an engine already on disk)
./test.sh       # run the test suite
./release.sh    # build the self-contained release jar the AppImage is made from
./package-appimage.sh   # build the AppImage, the only artefact that is released

The only compiled-in dependencies are BouncyCastle (the proxy CA) and a Brotli decoder. The scan engine, testing browser and a portable JDK are fetched on demand by ./fetch-zap.sh, ./fetch-browser.sh and ./fetch-jdk.sh; bundled versions are pinned in tools/versions. The portable JDK (Eclipse Temurin, built on an old glibc) is what lets the AppImage run across distributions rather than only on the build host. See DEPENDENCIES.md.

FAQ

Is there a free, open-source alternative to Burp Suite? Yes. OpenTRAP gives you the intercepting-proxy workflow Burp users know, with Proxy, Repeater, Intruder, Collaborator, Sequencer, Decoder and Comparer, under the AGPL-3.0 with no paid tier and no feature gate.

What is the difference between OpenTRAP and OWASP ZAP? OpenTRAP uses the OWASP ZAP engine for crawling and scanning, and puts a familiar, Burp-style interface and workflow on top of it. If you trust ZAP's detection but want a proxy-first workspace, OpenTRAP is that front end.

Does it have Repeater, Intruder and a Collaborator? Yes, along with HTTP history, a target site map and scope, a sequencer, a decoder, a comparer and a full traffic logger, all in one window.

Which platforms does it run on? Today OpenTRAP ships as a single self-contained Linux AppImage. It needs nothing installed: the Java runtime and the scan engine are inside the file.

Is it really free? Yes. OpenTRAP is released under the GNU AGPL v3.0. Every capability is open, with nothing reserved for a paid edition.

Licence

OpenTRAP is released under the GNU Affero General Public License v3.0. You are free to use, study, modify and share it; if you distribute a modified version or run one as a network service, you release your changes under the same licence, so improvements stay open for everyone. The full text is in LICENSE.

---

_{OpenTRAP is independent open-source software. It bundles third-party open-source components under their respective licences; see CREDITS.md.}