Burp Suite
Web application security testing toolkit built around an intercepting proxy, with a free Community Edition and paid professional and enterprise editions.
- Pricing
- Freemium
- Platforms
- LinuxWindowsmacOS
- Reviewed
- Last reviewed 24 September 2026
What it is
Burp Suite from PortSwigger is a desktop toolkit for testing web applications and APIs. Traffic passes through its intercepting proxy, where testers can inspect, modify and replay requests.
What it helps with
Manual web penetration testing: mapping an application, tampering with requests, and testing for issues such as injection and access-control flaws. The paid Professional edition adds an automated scanner. Burp Suite DAST offers scheduled scanning at enterprise scale.
Who it's for
Web penetration testers, bug bounty hunters and AppSec engineers.
Worth knowing
The Community Edition is free but limited compared with Professional. Extensions from the BApp Store add further capabilities. Test only applications you are authorised to test.