Burp Suite
DAST 2026.10.4 (2026-11-03) commercialThe section your link pointed to isn't on Burp Suite's page any more, so we've brought you to the top.
Burp Suite is a web vulnerability scanner and penetration testing toolkit available in multiple editions, including Professional, Community, and DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces..
Summary
Burp Suite is a commercial desktop application for testing the security of web applications, combining an intercepting proxy with a vulnerability scanner. It runs locally, intercepting and manipulating traffic between browser and server, which makes it a tool for application security testers and penetration testers rather than something deployed as a service. It sits in the web-app-security space alongside other DAST and proxy-based testing tools, covering the workflow of manually probing requests while also running automated scans. Recent releases refine traffic filtering with wildcard and IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support in the proxy exclusion list, track vulnerabilities with persistent identities across scans so findings can be followed over time, and add an agentic AI capability in the Professional edition that pursues user-defined testing goals autonomously. First launched in 2003, it remains under steady development, with 34 releases tracked and the most recent just 15 days ago.
Burp Suite is a web vulnerability scanner and penetration testing toolkit available in multiple editions, including Professional, Community, and DAST.
Burp Suite publishes no documentation we track, so the description above is written from general knowledge rather than the vendor's own words.
How Burp Suite helps
Which requests is my application actually making, and which of them could be manipulated to break it?
intercepts live traffic between browser and server so every request and response can be inspected and edited by hand before it goes further
Which pages and parameters in my application carry known vulnerability classes?
runs an automated scan across the application and reports issues found, tied to the specific request that triggered each one
Has this vulnerability I found last month been fixed or does it still linger?
assigns each finding a persistent identity that carries across scans, so the same issue can be followed over time instead of appearing as a new, unrelated result each run
Can a testing goal I define be pursued without me driving every request myself?
hands the goal to an agentic engine that uses the proxy's own tools to probe the application autonomously and raises issues from what it finds, with the relevant traffic highlighted for review
Which of my own traffic should the proxy leave alone while I test everything else?
matches requests against an exclusion list that accepts wildcard patterns and IPv6 addresses, so internal or unrelated hosts can be filtered out of what gets intercepted
How do I get my findings out of the tool and into a report or ticket?
exports the current issue list as a CSV file straight from the issues view for offline triage or write-up
Languages
Score card
-
Shipping velocity releases a month, last 12 months
-
Documentation quality release-notes rubric, 0–100
-
Breaking-change discipline how rarely a release breaks users, and notice given
-
Maintenance risk quiet time against its own cadence, maintainers
-
Innovation & surface new capabilities, API and MCP surface
Five scores for Burp Suite, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.
Score cards are part of every paid plan.
See plans → Already subscribed? Sign in →Trajectory
Blank means never measured; nothing here is a filled-in zero.
Peer standings are included with Researcher and Business. See how this tool ranks against its competitors, using data we don't publish anywhere else.
See plans →Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.
How this is scored
- Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
- Documentation quality — the release-notes rubric published on the analytics page, unchanged.
- Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
- Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
- Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
- Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
- Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
- Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.
Release-note detail over time
See how much detail Burp Suite puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.
Checking release-note history…
Website history
portswigger.net, every changePortSwigger's home page and 33 more pages as they looked each month from September 2021 to October 2026: 208 renders, 28 changes of tagline or palette. Step through them, play them, or put any two months side by side.
Website history is included with Researcher and Business.
See plans → Already subscribed? Sign in →← → or h l a month · Shift a year · [ ] previous / next change · Space play · 1 2 3 page · T whole page · C compare · F full size
← → or h l the right month · Shift the left · S swap · W wipe · T whole page · Esc back
Rebranding timeline
Dates bound when a change appeared between captures. Possible rebrands are AI suggestions; a redesign alone does not establish a rebrand.
Releases
11 entries
No entries match these filters.
- November 20261
- October 20263
- September 20262
- August 20262
- July 20262
- June 20261
Articles
23 articles · updated Nov 4, 2026Where Burp Suite turns up in what others publish: how-tos, attack reports that name it, and incident write-ups. A row says why it is here and quotes where the article names it; the link goes to the publisher.
Tutorials & guides 23
-
Burp Suite for Pentester: Autorize
Burp Suite has been a leader in this area for many years, and safety professionals as well as ethical hackers are still using it.
-
Burp Suite for Pentester: Repeater
Views Multiple views are provided to view the Request and the Response sections in the Burp Suite.
2 more quotes
…article, we’ll focus on the Repeater and its options featured by the Burp Suite Professional Version, which will help any Pentester to send the request inside the burp and observe its Response in real-time without…
…Redirection Search Reopening Closed Tab Views Exporting Repeater Data Conclusion Introduction Even the users that are just beginning to use the Burp Suite are likely to be familiar with the functions of the Repeater.
-
Burp Suite for Pentester: Burp’s Project Management
With the Intercept option turned OFF on our burp suite’s proxy tab, let’s switch to the Target tab , and there we can see the Site map is full of shared Requests and Responses.
2 more quotes
Manipulating Project Files With all these great options, the burp suite even gives us the opportunity to Save a copy of our running project or merge the work from other projects by importing them from the disk.
At the top of the Burp Suite’s panel, when we hover the Project option there, we got a dropdown where a number of options aligned, let’s hit the Save Copy one.
-
Burp Suite for Pentester: Software Vulnerability Scanner & Retire.js
Instead, we will explore some useful Burp Suite extensions that can help us identify the vulnerable versions of the software or libraries installed within an application.
2 more quotes
To dig deeper into a web application, Burp Suite offers some amazing plugins.
Let’s get back to our burp suite monitor and will switch to the dashboard tab there.
Show all 23
-
Burp Suite for Pentester: Active Scan++
Using Burp Suite as an automated scanner?
2 more quotes
As soon as the file got stored up over at the local machine, we’ll embed it with our Burp Suite application.
Now, let’s navigate to the Target option over at our burp suite monitor, further head to the Site map .
-
Burp Suite for Pentester: Turbo Intruder
It is a Burp Suite extension that can produce results within minutes, regardless of the number of payloads embedded in the dictionary.
2 more quotes
Simply navigate to the Extender tab in Burp Suite , then select the BApp Store option.
To learn more about Burp Suite for Pentester .
-
Burp Suite for Pentester: Burp Sequencer
for the Professional and community version , you just need to tune in your burp suite application and navigate to the Sequencer tab over at the top panel.
2 more quotes
Let’s check our burp suite, whether it captured the request or not.
Thus, over in such cases, the burp suite’s creators give us the opportunity to define the Custom location within the response.
-
Burp Suite for Pentester: HackBar
So, today in this article we’ll explore one of the best burp suite’s plugins “Hack Bar” which will speed up all of our manual payload insertion tasks and will work with almost all the major vulnerabilities.
2 more quotes
In Burp Suite’s Repeater tab, open a new section.
To learn more about Burp Suite for Pentester .
-
Burp Suite for Pentester: Burp Collaborator
So, today in this article of the series of Burp Suite for Pentester, you’ll learn how to detect out-of-band or blind vulnerabilities using one of the most amazing features of Burp Suite, i.e., Burp Collaborator.
2 more quotes
In simpler terms, this collaborator essentially serves as a network service that Burp Suite uses to detect out-of-band vulnerabilities.
Burp Collaborator Server Burp Suite uses the Burp collaborator server as a service while auditing or testing vulnerable web applications to find sections that interact with an external system.
-
Burp Suite for Pentester: Web Scanner & Crawler
To do this, we will use one of the best intercepting tools – “ Burp Suite ”.
2 more quotes
Crawl with default configurations Customizing the Crawler Vulnerability Scanning over Burp Suite Auditing with default configurations.
If you’re familiar with the spider feature, you might know that the spider holds a specific tab within Burp Suite’s panel.
-
Burp Suite for Pentester – Fuzzing with Intruder (Part 3)
Thereby, for such a situation, where we need to set different input parameters as injection points, we can use the other attack types offered by Burp Suite.
2 more quotes
Fuzzing with Payload Type As we’re aware of this fact that the payload type in Burp Suite’s Intruder tab is designed to manage and create payloads at our convenience.
Therefore, to differentiate the two, Burp Suite includes a built-in payload type called “Brute Forcer.” It takes an input string and generates payloads of specified lengths, containing all possible permutations of a…
-
Burp Suite for Pentester – Fuzzing with Intruder (Part 2)
In the previous article , we learned about what fuzzing is and how the Burp Suite helps us to fuzz a web application.
2 more quotes
Along with all these things, we had even explored some great fuzzing payload lists that the Burp Suite’s Intruder tab offers.
So, today, in this article, we’ll investigate some other amazing pre-defined Burp Suite’s payload lists that could thereby hit a crucial vulnerability.
-
Burp Suite for Pentester – Fuzzing with Intruder (Part 1)
How Burp Suite work as a Fuzzer?
2 more quotes
Burp Suite comes with an integrated HTML Fuzzer , commonly termed as a Burp Intruder.
However, Burp Suite’s Professional Edition gives us an option to opt the predefined lists containing the most common fuzz strings according to the attack types.
-
Burp Suite for Pentester – XSS Validator
However, the BAPP Store might have removed some extensions, or we need to set up ours in Burp Suite.
2 more quotes
Over at the tabs provided at the Burp Suite monitor, navigate to the Extender tab , opt the BApp sub-tab there, such in order to check the list of the provided extensions.
To learn more about Burp Suite for Pentesters .
-
Burp Suite for Pentester – Configuring Proxy
Burp Suite, you might have heard about this great tool and even used it several times in your bug hunting or penetration testing projects .
2 more quotes
Table of Content Introduction to Burp Suite Burp Suite Installation Configuring Burp Proxy for Web Applications Manual Configuration Using Firefox Extension Configuring Burp Proxy for Android Applications Introduction…
Burp Suite is a collection of tools that seamlessly work together to facilitate the entire penetration testing process.
-
Burp Suite for Pentester: Engagement
Today we are going to discuss the Importance of Engagement tools which is a Pro-only feature of Burp Suite.
2 more quotes
To make use of this function, select an HTTP request anywhere in Burp Suite, or any part of the site map, and choose “Find references” in “Engagement tools” from the context menu that appears when you click the Action…
Then click on enter after writing the URL of the Vulnerable Web in your browser, then the burp suite will capture the request of the web page in the intercept tab.
-
Payload Processing Rule in Burp Suite (Part 2)
Then click on login, the burp suite will capture the request of the login page in the intercept tab.
2 more quotes
Thus the sent request will be captured by burp suite which you can see in the given below image.
We have simply clicked on the Redirection link as shown in the image; the burp suite will capture the request of the redirecting page in the intercept tab.
-
Payload Processing Rule in Burp Suite (Part 1)
Then click on login, the burp suite will capture the request of the login page in the intercept tab.
2 more quotes
Sit back and relax because now the burp suite will do its work, match the password which will give you the correct password.
Source: portswigger.net To learn more about Burp Suite for Pentesters .
-
Beginners Guide to Burp Suite Payloads (Part 2)
Then click on login, the burp suite will capture the request of the login page in the intercept tab.
2 more quotes
Sit back and relax because now the burp suite will do its work, match the password and will give you the correct password.
Sit back and relax because now the burp suite will do its work, match the username and password which will give you the correct username and password.
-
Burp Suite Encoder & Decoder Tutorial
Today we are discussing the Decoder Option of ‘Burp Suite’.
2 more quotes
Burp Suite is a tool which is used for testing Web application security.
There are 9 types of decoder format in Burp Suite: Plain text URL HTML Base64 ASCII Hex Hex Octal Binary Gzip URL Encoder & Decoder When you will explore decoder option in burp suite you will observe two sections left…
-
Beginners Guide to Burp Suite Payloads (Part 1)
Today we are discussing about the “Types of Payload in Burp Suite”.
2 more quotes
Burp Suite is an application which is used for testing Web application security.
We are going to use the Intruder feature of Burp Suite, it is used to brute force web applications.
-
Sql Injection Exploitation with Sqlmap and Burp Suite (Burp CO2 Plugin)
Burp CO2 is an extension for the popular web proxy/web application testing tool called Burp Suite, available at Portswigger.
2 more quotes
You must install Burp Suite before installing the Burp CO2 extension.
Set your browser proxy to make burp suite work properly.
Add the badge to your README
Maintain this project? The badge links readers straight to this page, so they can follow every release here.
Choose a badge style and copy the code →