OWASP ZAP

The world's most widely used web app scanner for automated security testing and manual penetration testing.

ZAP (Zed Attack Proxy) acts as a man-in-the-middle proxy to intercept and inspect traffic between your browser and the web application. It packs a punch with its automated scanner for common vulnerabilities like SQL injection and XSS, while providing power users with a Fuzzer and a HUD (Heads Up Display) for real-time manipulation. Whether you are running it in a CI/CD pipeline via the ZAP Docker image or performing deep-dive manual audits, its open-source framework remains the industry standard for securing modern web interfaces.

https://www.zaproxy.org