OpenTRAP

Open Traffic Replay and Analysis Proxy - an open-source, community-driven web security testing suite built around an intercepting HTTP proxy.

Capture, inspect, replay and tamper with the traffic between a browser and a web application, map an application’s attack surface, crawl and audit it for real vulnerabilities, and drive repeatable manual and automated testing from one workspace, all with a familiar, recognisable workflow.

OpenTRAP dashboard with a crawl finished, an active audit running, and the live table of the most serious vulnerabilities found

A live audit on the Dashboard: crawl complete, active scan running, high-severity findings arriving as they are confirmed.

Star

Download the latest AppImage for Linux (one file, nothing to install), then see Get started below. All releases are on the releases page.

Why OpenTRAP

See it in action

Every tool lives in one window. Click any screenshot for the full-size image.

Target tab: site map tree, request list, and the issues found with a full advisory for a reflected cross-site scripting finding

Target. The site map and scope on the left, every request in the middle, and every issue found on the right. Select a finding and the advisory, request and response are beside it, with severity, confidence, parameter and CWE ready to hand to a developer.

Built-in Chromium browser opened from the Proxy tab, routed through the proxy and showing the certificate authority page

Built-in browser. Click open browser on the Proxy tab and a bundled Chromium starts in an isolated profile, already routed through the proxy and already trusting OpenTRAP’s certificate authority. TLS interception works with nothing to configure and no certificate to install.

Collaborator tab listing captured out-of-band DNS and HTTP interactions with the request to the collaborator shown

Collaborator. Generate a payload, put it in a request, and watch the out-of-band DNS and HTTP interactions arrive. Every callback is recorded with its source and full request, so blind vulnerabilities can be proven, not guessed at.

Passive tab listing the scan engine's detection rules with enabled checkboxes, quality and alert threshold columns

Passive rules. Every detection rule in the engine in one filterable list. Switch rules on or off, move the alert threshold per rule, and add your own detection rules, with changes applied to the engine that runs your scans.

Logger tab with a filterable table of every request made by the audit, with request and response viewers below

Logger. A complete record of every request OpenTRAP and the scan engine make, tagged by the tool that sent it, with the request and response viewers below. Nothing happens behind your back.

Get started

Download the latest release from the releases page and run it. Nothing to install.

Recommended: the AppImage - one self-contained file, no Java needed. This link always points at the latest release: opentrap-x86_64.appimage

Or from a terminal, fetch it:

wget https://github.com/opentrap/opentrap/releases/latest/download/opentrap-x86_64.appimage

make it executable:

chmod +x opentrap-x86_64.appimage

and run it:

./opentrap-x86_64.appimage

You can also double-click the downloaded file in your file manager.

Or the jar, if you already have Java 17 or newer. This link also always points at the latest release: opentrap.jar

Run it with:

java -jar opentrap.jar

The scan engine is built in and sets itself up on first run; the optional testing browser is an in-app download when you want it.

Learn more

OpenTRAP is independent open-source software, released under the GNU AGPL v3.0. See the repository for full credits and component licences.