What is it?
OpenTRAP is an intercepting proxy for web application security testing. Browser traffic goes through the proxy, where you inspect, edit and replay it, and a wizard runs a crawl and then an audit against a target. The interface follows Burp Suite's layout of tabs (Proxy, Repeater, Intruder, Collaborator and so on), while detection comes from the OWASP ZAP engine.
Why is it interesting?
- Burp's manual toolset with no paid edition: Repeater to reissue a request, Intruder with four attack types, Sequencer for token entropy, Decoder, Comparer, Organizer and a Logger of every request sent. The code is under the AGPL-3.0, and no feature sits behind a licence.
- ZAP's scanner without ZAP's interface: ZAP runs as a child process on the loopback, driven through its JSON API, and its findings are mapped into OpenTRAP's own issue model. The beta rule packs ship on top of the core ones; the noisier alpha rules are left out. The four scan tiers (Lightweight, Fast, Balanced, Deep) test for the same flaws and only differ in how deep they go.
- A Chromium ready to intercept: one click opens Chromium in an isolated profile, already routed through the proxy and trusting its certificate authority. There is no certificate to install, and the browser is only downloaded if you ask for it.
- Small project files: an audit's thousands of probe requests are kept as headers only, which brings a scan-heavy project down to roughly a tenth of its size, according to the FAQ. The crawl, your manual traffic and every finding are kept in full.
- No AI features, on principle: the README rules them out of the roadmap, on the grounds that a security tool runs where sending traffic to a third-party model is not acceptable.
Good to know
Linux x86_64 only. The one published artifact is a 228 MB AppImage that bundles its own Java runtime and the ZAP 2.17.0 engine. The project ships nothing for Windows or macOS.
The interface is ahead of the code. The roadmap lists fifteen features that are drawn in the interface but not implemented: logging in to the application before a scan, API-only scans, the live task and live crawl view, the console, and the whole Extensions tab (installed extensions, store, API, custom checks). Clicking one opens a dialog that gives its reference code and explains how to contribute it.
Collaborator uses a public server by default. Out-of-band interactions go through the interactsh protocol, the one Nuclei uses, with the public oast.pro instance as the default server. According to the code, interactions come back encrypted to the client's RSA key, so the server cannot read them. A self-hosted interactsh instance can be set when an engagement forbids routing target data through a third party.
A repository opened on 19 October 2026. It shipped 26 releases up to 25 October, named after a timestamp (20261025-221014) and with no version number. The latest one reports 24 test suites and 104 cases. The maintainer authored 78 of the 139 commits, and one contributor another 49.