Zed Attack Proxy (ZAP)

Zed Attack Proxy (ZAP) by Checkmarx is a free, open-source penetration testing tool. ZAP is designed specifically for testing web applications and is both flexible and extensible. It works with OpenAPI descriptions and can be used for automated scans as well as a set of tools that allow you to find security vulnerabilities manually.