Burp Suite
By PortSwigger
Burp Suite is an integrated platform for web application security testing, widely used by penetration testers and security researchers to discover and exploit vulnerabilities.
Definition
Burp Suite is an integrated platform for web application security testing, widely used by penetration testers and security researchers to discover and exploit vulnerabilities.
Overview
At its core, Burp Suite runs as an intercepting HTTP(S) proxy, sitting between a browser and a target web application so every request and response can be inspected and modified. Its Repeater tool lets testers manually resend and tweak individual requests, while Intruder automates sending large numbers of crafted requests for fuzzing and brute-force-style testing; the paid Professional and Enterprise editions add an automated vulnerability Scanner that crawls and tests an application for common issues. Developed by PortSwigger, Burp Suite has become one of the two most widely used tools — alongside OWASP ZAP — in professional web application penetration testing, and the categories of issues it's used to find map closely to what's covered in Cybersecurity for Developers: The OWASP Top 10 Explained. Its functionality can be extended through the BApp Store, a marketplace of community-built extensions, and it's frequently used alongside identity and access tools like Auth0 or Keycloak when testing authentication and session-handling flaws.
Key Features
- Intercepting HTTP(S) proxy for inspecting and modifying traffic
- Repeater for manual request manipulation and replay
- Intruder for automated fuzzing and brute-force-style attacks
- Automated vulnerability Scanner (Professional/Enterprise editions)
- Extensibility through the BApp Store plugin marketplace
- Session handling rules and macro recording for authenticated testing
- Comparer and Sequencer tools for analyzing tokens and session data
Use Cases
Frequently Asked Questions
From the Blog
How to make a CI test suite fast and reliable
Restore trust in your pipeline: quarantining flaky tests, finding the real causes, splitting suites for parallelism and selecting tests by what changed.
Read More AI & TechnologyLLM Evaluation: Building a Test Suite for Generative Output
You can test non-deterministic output by fixing the inputs, grading against a rubric rather than an exact string, and gating releases on aggregate thresholds instead of per-case pass or fail. This guide shows how to assemble that suite: dataset, scorers, run harness, thresholds and the CI wiring that makes it enforceable.
Read More AI & TechnologyUsing AI assistants to write tests without weakening your test suite
Assistants scaffold tests well and choose assertions badly. Learn a workflow that keeps you deciding what to assert while the tool writes the mechanical parts.
Read More ProgrammingPython Testing Explained: Fixtures, Mocks, and Coverage
A good Python test suite is layered: fast isolated tests for logic, slower integration tests against real dependencies, and a small number of end-to-end checks. This guide sets out that spectrum, the pytest features that make each layer manageable, and how to tell whether your suite is actually trustworthy.
Read More