Burp Suite

What it is

Burp Suite is a commercial desktop toolkit for web application and API security testing, made by PortSwigger, that routes browser and client traffic through an intercepting proxy so testers can inspect, modify and replay HTTP(S) requests. Editions include the free Community Edition, paid Burp Suite Professional for hands-on testers, and Burp Suite DAST for automated enterprise scanning.

What it helps with

- Intercept and alter requests and responses during manual web and API testing.
- Map application attack surface and repeat interesting requests from history.
- Test for injection, access-control and other common web flaws with manual workflows.
- Run automated crawling and scanning in Professional (and scaled DAST pipelines in the enterprise product).
- Extend the toolkit via the BApp Store and custom extensions.
- Support bug bounty, pentest and AppSec review workflows on authorised targets.

Who it's for

Web penetration testers, bug bounty hunters, and application security engineers who need a proxy-centred testing workbench.

Worth knowing

Community Edition is free but omits capabilities reserved for Professional (notably the full automated scanner). Desktop clients are available for Windows, Linux and macOS. Test only applications and APIs you are authorised to assess. Product lines and edition roles are described on portswigger.net/burp.