opentrap/opentrap

选用指南

AI 根据 README 整理 · 2026/10/20 07:31:48

适用场景

适用于 Web 应用渗透测试、漏洞赏金狩猎、应用安全工程和教学场景，提供拦截、重放、篡改流量、攻击面映射及自动化扫描等功能。

查看 README 依据

rather than steered by a single vendor's roadmap. If a security tester can describe a better way to work, OpenTRAP should be the tool that lets them build it. ## What it is A proxy-first workspace for web application testing. Capture, inspect, replay and tamper with the traffic between a browser and a web application. Map an application's attack surface, and drive repeatable manual and automated testing from one window: interception, HTTP history, a target site map and scope, a request toolset, an out-of-band collaborator, and a complete log of everything that runs.

It is built for penetration testers, bug bounty hunters, AppSec engineers and students who want a professional intercepting-proxy workflow without a commercial licence. ## See it in action <table> <tr> <td width="50%" valign="top"> <a href="docs/images/target.png"><img src="docs/images/target.png" alt="Target tab: site map tree, request list, and the issues found with a full advisory for a reflected cross-site scripting finding"></a> <br>_{<b>Target</b><br>Site map, scope and every issue found, with the advisory, request and response beside it.} </td> <td width="50%" valign="top">

目标用户

面向渗透测试人员、漏洞赏金猎人、AppSec 工程师和学生。

查看 README 依据

It is built for penetration testers, bug bounty hunters, AppSec engineers and students who want a professional intercepting-proxy workflow without a commercial licence. ## See it in action <table> <tr> <td width="50%" valign="top"> <a href="docs/images/target.png"><img src="docs/images/target.png" alt="Target tab: site map tree, request list, and the issues found with a full advisory for a reflected cross-site scripting finding"></a> <br>_{<b>Target</b><br>Site map, scope and every issue found, with the advisory, request and response beside it.} </td> <td width="50%" valign="top">

使用方式

通过下载 Linux AppImage 运行，无需安装，内置 Java 运行时和扫描引擎；也可从源码构建。

查看 README 依据

| **Sequencer** | Token randomness analysis with entropy tests | | **Decoder / Comparer** | Chained encode/decode/hash transforms, and item diffs | Right-click any request or response to send it between tools. ## Get started Download the latest release from the [releases page](https://github.com/opentrap/opentrap/releases/latest) and run it. Nothing to install. **One file: the AppImage.** It bundles its own Java runtime and the scan engine,

so there is no Java to install. This link always points at the latest release: [opentrap-x86_64.appimage](https://github.com/opentrap/opentrap/releases/latest/download/opentrap-x86_64.appimage) Or from a terminal, fetch it: ``` wget https://github.com/opentrap/opentrap/releases/latest/download/opentrap-x86_64.appimage ``` make it executable: ``` chmod +x opentrap-x86_64.appimage ``` and run it: ``` ./opentrap-x86_64.appimage ``` You can also double-click the downloaded file in your file manager. The download is complete: the Java runtime and the scan engine are inside the

./build.sh # compile src/ into a lean dev jar (uses an engine already on disk) ./test.sh # run the test suite ./release.sh # build the self-contained release jar the AppImage is made from ./package-appimage.sh # build the AppImage, the only artefact that is released ``` The only compiled-in dependencies are BouncyCastle (the proxy CA) and a Brotli decoder. The scan engine, testing browser and a portable JDK are fetched on demand by `./fetch-zap.sh`, `./fetch-browser.sh` and `./fetch-jdk.sh`; bundled

部署要求

需要 Linux 平台，AppImage 自带 Java 运行时和扫描引擎，无需额外安装 Java。

查看 README 依据

OpenTRAP uses the OWASP ZAP engine for crawling and scanning, and puts a familiar, Burp-style interface and workflow on top of it. If you trust ZAP's detection but want a proxy-first workspace, OpenTRAP is that front end. **Does it have Repeater, Intruder and a Collaborator?** Yes, along with HTTP history, a target site map and scope, a sequencer, a decoder, a comparer and a full traffic logger, all in one window. **Which platforms does it run on?** Today OpenTRAP ships as a single self-contained Linux AppImage. It needs nothing

so there is no Java to install. This link always points at the latest release: [opentrap-x86_64.appimage](https://github.com/opentrap/opentrap/releases/latest/download/opentrap-x86_64.appimage) Or from a terminal, fetch it: ``` wget https://github.com/opentrap/opentrap/releases/latest/download/opentrap-x86_64.appimage ``` make it executable: ``` chmod +x opentrap-x86_64.appimage ``` and run it: ``` ./opentrap-x86_64.appimage ``` You can also double-click the downloaded file in your file manager. The download is complete: the Java runtime and the scan engine are inside the

已知限制

目前仅提供 Linux AppImage，不支持其他平台；可选测试浏览器需在应用内下载。

查看 README 依据

OpenTRAP uses the OWASP ZAP engine for crawling and scanning, and puts a familiar, Burp-style interface and workflow on top of it. If you trust ZAP's detection but want a proxy-first workspace, OpenTRAP is that front end. **Does it have Repeater, Intruder and a Collaborator?** Yes, along with HTTP history, a target site map and scope, a sequencer, a decoder, a comparer and a full traffic logger, all in one window. **Which platforms does it run on?** Today OpenTRAP ships as a single self-contained Linux AppImage. It needs nothing

file and set themselves up on first use. Every release is this one AppImage, so nothing ships with parts missing. The optional testing browser is an in-app download, offered only when you want it, so the release stays small. The fastest way to test a target is the built-in browser: on the **Proxy** tab click **open browser**. It launches a bundled Chromium in an isolated profile, already routed through the proxy and already trusting OpenTRAP's certificate authority, so there is nothing to configure and no certificate to install. ## Build from source ```