What is Burp Suite: complete guide to web pentesting 2026

Burp Suite by PortSwigger is the industry standard tool for web application penetration testing. It combines a MITM interception proxy, an active and passive scanner, an advanced fuzzer and an extension framework in a single platform. From startups to regulated entities under PCI DSS or ISO 27001, virtually every offensive consultancy operates with Burp Suite as the core of its testing chain, complementing it with open-source tooling and modern alternatives such as Caido.

Burp Suite at a glance

• It is the reference MITM proxy for auditing HTTP/HTTPS traffic of web applications and APIs.
• Three available editions: Community (free and limited), Professional (annual per-user license) and Enterprise (automated scanning at scale).
• Its key modules are Proxy, Repeater, Intruder, Scanner, Decoder, Comparer, Sequencer and Collaborator.
• The BApp Store offers hundreds of extensions extending the product for JWT, authorization, distributed fuzzing or WAF evasion.
• Burp Suite Enterprise integrates into CI/CD pipelines via API for automated DAST scanning on every deployment.

What Burp Suite is and why it became the de facto standard

Burp Suite was born in 2003 as a utility written by Dafydd Stuttard, author of the industry reference The Web Application Hacker's Handbook. What started as a lightweight proxy became the engine of PortSwigger Web Security, headquartered in Knutsford (United Kingdom) and considered the leading authority in web vulnerability research alongside OWASP.

The consolidation as a de facto standard is explained by three factors. First, its learning curve allows a junior to start with the Proxy in minutes while a senior leverages Collaborator or Turbo Intruder. Second, the Web Security Academy uses Burp as the official tool, training an entire generation of pentesters already familiar with it. Third, the BApp Store widens the product in any direction.

The serious alternatives are OWASP ZAP (free, OWASP Foundation) and Caido (modern challenger with native client-server architecture). ZAP is comparable for basic tasks and well integrated in CI/CD, while Caido provides better usability for long audits. Even so, Burp continues to lead market share when clients demand auditable results and commercial support.

Burp Community vs Professional vs Enterprise

PortSwigger markets three editions. The choice depends on usage profile, audit volume and whether scanning must be automated in pipelines. The table summarizes the most relevant technical and commercial differences.

Community is the entry point to learn how the proxy works or solve CTFs and Web Security Academy labs. Professional is the choice of most pentesters, as it unlocks Scanner, removes throttling and lets them work at real speed. Enterprise is designed for in-house AppSec teams that need to automate scans across tens or hundreds of applications and deliver continuous results to development.

Main modules

Burp Suite is not a single tool but a collection of integrated modules sharing the same proxy and Target site map. Mastering them separates an advanced auditor from a beginner.

Proxy (MITM interception)

The Proxy is the heart of the product. It acts as a man-in-the-middle between the auditor's browser and the target application, capturing every HTTP/HTTPS request and response. It allows real-time interception, parameter modification before requests reach the server or logging all traffic in the HTTP history. It supports WebSockets, HTTP/2 and listens by default on 127.0.0.1:8080. Installing the Burp root certificate as a trusted CA in the browser is the mandatory step to inspect TLS without warnings. The Proxy is also the launch point for the other modules via context menu: Send to Repeater, Send to Intruder, Send to Comparer.

Repeater (manual request crafting)

Repeater lets the auditor take a captured HTTP request, modify it at will and resend it as many times as needed to observe server behavior under controlled variants. It is the module where any auditor spends most time during manual testing, especially to validate scanner findings, adjust injection payloads or probe authorization logic across users. Each request lives in a dedicated tab and dozens can be kept open in parallel, with syntax highlighting for JSON, XML, HTML and URL-encoded parameters.

Intruder (fuzzing and enumeration)

Intruder is Burp's automated fuzzing engine. It allows marking one or several injection points within a request and bombarding the server with payloads defined by the user: password dictionaries, SQLi or XSS payloads, numeric IDs to detect IDORs, session identifiers. It offers four attack modes (Sniper, Battering Ram, Pitchfork, Cluster Bomb) combining positions and payloads in different ways. Response analysis is done by status code, length, time or regex. In Community, throttling reduces its speed drastically, making it unusable for serious enumeration without upgrading to Professional.

Scanner (active and passive, Pro and Enterprise only)

The Scanner is the integrated DAST module. It works in two complementary modes. The passive scanner analyzes traffic already flowing through the proxy without sending new requests: cookies without the Secure flag, missing security headers, sensitive information in responses. The active scanner sends payloads designed to reveal vulnerabilities, covering reflected and stored XSS, SQL injection, command injection, SSRF, insecure deserialization, XXE and other OWASP Top 10 categories. The quality of Burp's scanner is widely recognized as the best among commercial DAST tools.

Decoder (encoding and decoding)

Decoder converts text between URL encoding, Base64, HTML entities, hex, octal and other representations. It is common to chain several decodings to inspect opaque tokens, multi-encoded parameters or obfuscated payloads a WAF tried to detect.

Comparer (diff of requests and responses)

Comparer shows differences between two requests or responses at byte or word level. It is useful to detect subtle discrepancies between an authenticated and an anonymous response, between two roles with distinct permissions, or between requests with one parameter altered. It quickly confirms whether a change in the request triggers a change in the response.

Sequencer (session token analysis)

Sequencer evaluates the cryptographic quality of session tokens, anti-CSRF identifiers or any value that should be unpredictable. It collects thousands of samples and applies standard statistical tests (FIPS 140-2 among them) to estimate effective entropy. A token with low entropy is a serious vulnerability enabling account takeover by brute force.

Collaborator (out-of-band SSRF, blind XSS)

Burp Collaborator is an external service that assigns a unique subdomain per session and registers any incoming network interaction (DNS, HTTP, SMTP). It is the piece that makes blind vulnerability detection possible: if an SSRF payload causes the target server to resolve the Collaborator subdomain, the vulnerability is proven even without visible HTTP response. The same applies to blind XSS, blind XXE and out-of-band exfiltration.

Target site map

The Target site map maintains a hierarchical tree of every host, path and parameter discovered by the proxy. It serves as a visual inventory of the audited scope, allows filtering by content type or response code and is the foundation on which selective scans are launched. A thorough site map conditions the quality of all subsequent work.

Basic proxy setup for an audit

The first step of any audit is configuring the proxy correctly. Burp listens by default on 127.0.0.1:8080, but the workflow varies depending on the device originating the traffic.

The cleanest option is a dedicated Firefox configured exclusively for audits, with the system proxy pointed at Burp and the PortSwigger root certificate imported into Firefox's own authority store. This avoids polluting the personal browser with pentesting CAs. The certificate is downloaded by visiting http://burp with the proxy active.

For mobile devices, integration is done with Foxy Proxy or by configuring the proxy at WiFi network level pointing to the IP of the machine running Burp. For Android emulators (AVD), installing the Burp CA as a system certificate requires remounting the /system partition in write mode. iPhones and iPads require installing the configuration profile and enabling full trust under Settings > General > About > Certificate Trust Settings.

When the client application does not honor the system proxy (certain native or IoT clients), the solution is a transparent proxy through iptables rules redirecting HTTPS traffic to the Burp port, with Support invisible proxying enabled on the listener.

Typical pentest workflow with Burp

A professional web pentest follows well-defined phases, and Burp supports each of them.

Phase 1, passive recon. Before touching the application, the auditor browses manually through every accessible feature with the proxy logging traffic in HTTP history. The objective is to understand the data model, authentication flows and technology stack. The passive scanner raises alerts in parallel without active traffic.

Phase 2, mapping. The Target site map is completed by browsing with each available role (anonymous, standard user, administrator) until a full inventory of endpoints, parameters and HTTP methods is in place.

Phase 3, scanning. An active scan is launched against the Target tree. In Professional it is done endpoint by endpoint, controlling load and avoiding destructive functionality. In Enterprise the scheduler manages the full scan and delivers a consolidated report.

Phase 4, manual testing. Manual work with Repeater and Intruder is where business logic vulnerabilities surface that no scanner detects: privilege escalation across tenants, race conditions, IDORs in non-trivial identifiers, flaws in password recovery flows.

Phase 5, exploitation. For critical findings, a reproducible PoC is built, ideally a curl request or Python script that any client engineer can execute without Burp.

Phase 6, reporting. The final report cross-references scanner findings with manual ones, assigns CVSS severity and prioritizes remediation. Report quality matters as much as finding quality.

Essential extensions from the BApp Store

The BApp Store is the official repository of extensions. Some have become essential for professional audits.

• Logger++: logs all traffic with regex search and CSV export. Ideal for long audits.
• Autorize: automates access control testing. With a low-privilege cookie, it replays each high-privilege request and compares responses. Detects IDORs and authorization bypasses within minutes.
• JWT Editor: edits, signs and verifies JWT tokens from Burp. Essential for APIs authenticated with JSON Web Tokens.
• Active Scan++: extends the active scanner with additional OAST, host header injection, CRLF and other checks.
• Param Miner: discovers hidden parameters by comparing responses. Finds undocumented parameters that expand attack surface.
• Reflected Parameters: identifies parameters whose value is reflected in the response, first step for reflected XSS.
• Turbo Intruder: Python-scripted fuzzing engine reaching thousands of requests per second. Essential for race conditions.
• Bypass WAF: applies known evasion techniques to payloads in order to bypass web application firewalls.
• GAP (Get All Parameters): extracts parameters and endpoints from the application's own JavaScript code.

Burp Suite in CI/CD and DevSecOps

Burp Suite Enterprise integrates into continuous pipelines. The architecture is client-server, with a central controller orchestrating distributed scanning agents. The REST API allows launching scans from Jenkins, GitHub Actions or GitLab CI on every staging deployment, collecting JSON or HTML results and blocking the pipeline when vulnerabilities exceed a configured threshold.

The trade-offs against pure DAST tools such as Acunetix or Netsparker are well known. Burp Enterprise has better technical depth and benefits from all PortSwigger research, but per-application scan time tends to be longer and configuring authenticated crawlers requires a steeper curve. For mature AppSec teams already using Professional, the transition to Enterprise is natural.

Open-source and commercial alternatives

OWASP ZAP is the most capable free option, maintained by the OWASP Foundation. Its active scanner is solid but its interface feels less polished than Burp's. It has excellent CI/CD integration through command line and daemon mode. Caido has emerged as a modern challenger with native client-server architecture and focus on multi-auditor collaboration. Its scanner does not yet reach Burp Professional coverage, but its usability for long sessions is superior. Acunetix and Netsparker (now Invicti) are purely commercial DAST products focused on enterprise-scale automated scanning, without manual testing capability integrated at Burp's level.

Difference between Burp Scanner and a human pentester

An automated scanner (Burp Scanner, ZAP, Acunetix) detects reproducible technical vulnerabilities from known payloads: injections, XSS, insecure headers, default configurations. Its coverage over the technical OWASP Top 10 is high and false positives are low among leading tools. What no scanner detects is business logic: that a user can transfer money without validation, that a discount can be applied twice, that an API leaks data from another tenant when a non-obvious identifier is altered, or that a password recovery flow has an exploitable race condition. That territory belongs exclusively to the human pentester, who understands the business context and formulates attack hypotheses no automated tool can generate.

The consolidated best practice is to combine both: the scanner covers the reproducible technical baseline and frees auditor time to focus on business logic and vulnerability chaining.

Frequently asked questions

Is Burp Suite Community enough to get started?

Yes, for learning and labs Community covers the essentials. The official Web Security Academy labs are designed to be solved with Community. The limitation appears in real audits: the absence of an active Scanner forces all work to be done manually and Intruder throttling makes serious enumeration unfeasible.

Is legal authorization required to audit with Burp?

Yes, without nuance. Auditing an application without explicit written authorization from the owner constitutes unauthorized access to information systems, a criminal offense under the Spanish Criminal Code (article 197 bis) and equivalent European legislation. Burp use is only legal on your own assets, with a signed pentesting contract or on labs designed for it.

Does Burp support REST and GraphQL APIs?

Yes, without restrictions. The proxy captures any HTTP traffic regardless of body format (JSON, XML, GraphQL, gRPC over HTTP/2). For GraphQL there are specific extensions such as GraphQL Raider or InQL that help introspect the schema and fuzz queries and mutations.

Does Burp integrate with OWASP ZAP?

Not directly, but both can be chained as serial proxies if needed. The common practice is to pick one as primary tool. Some Burp extensions allow importing and exporting ZAP-compatible formats for migration scenarios.

Approximate annual cost?

PortSwigger publishes the Professional price as an annual per-user license. Enterprise is priced by number of concurrent scans and most organizations contact the commercial team directly for a tailored quote. Figures should be confirmed at purchase time to avoid outdated references.

Are there serious open-source alternatives?

OWASP ZAP is the most capable open-source alternative, with coverage comparable to Burp Professional in many vectors. Caido has a hybrid license with free and paid tiers. Beyond these two, the open-source ecosystem is fragmented into specialized tools (sqlmap, ffuf, nuclei) that serve specific purposes but do not provide an integrated suite.

Related resources

• Web application penetration testing: 2026 guide
• API penetration testing: REST and GraphQL
• What is penetration testing: a business guide
• White box vs black box vs gray box testing
• The 5 most common web vulnerabilities in 2026
• OWASP Top 10 for business vulnerabilities

Professional web pentesting with Secra

At Secra Solutions our web pentesting team combines Burp Suite Enterprise as automated scanning engine, Caido for long manual sessions and in-house tools for bypass, race conditions and business logic abuse. We cover OWASP Web Top 10, OWASP API Security Top 10 and OWASP MASVS, with auditable reports aligned with ISO 27001, ENS and PCI DSS.

If your organization needs a rigorous web audit, write to us through our contact page and we plan the scope with you.