OWASP ZAP
Free intercepting proxy, the open alternative to Burp.
OWASP's intercepting proxy: it sits between the browser and the application to see, stop and modify every request. It covers the same ground as Burp Community and a bit more, because its **active scanner** is not crippled: it can crawl the whole application and run automated injection, XSS and configuration checks. It is free and has an API, so it is the choice when automation matters or when a Burp Pro licence is not on the table.
Family Web exploitation
Flags (proxy en 8080, spider, active scan)
Concepts Web Content Discovery (Directory Fuzzing), IDOR / Broken Access Control, Cross-Site Request Forgery (CSRF)
Cheatsheet Discovery & fuzzing
Installation
sudo apt install zaproxyUseful commands
Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.