Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Burp Suite is PortSwigger’s toolkit for testing web application security. It puts a controllable proxy between a browser and an application so a tester can inspect and change the traffic they exchange. Proxy, Repeater, Intruder, and—on eligible editions—Scanner support different stages of that work. Burp Suite is a testing tool, not a vulnerability or a guarantee that an application is secure.
What Burp Suite is used for
Burp Suite helps security testers examine how a web application behaves when it receives particular requests. A tester can capture an HTTP or WebSocket message, inspect its contents, alter a value, send it again, and compare the application’s response. This makes behavior visible that may not be apparent from clicking through the application in a browser.
The tools work together: a request captured in Proxy can be sent to Repeater for manual retesting or to Intruder for repeated variations. Scanner can automate crawling and auditing in editions that include it. Automated results are leads to review, not proof by themselves; PortSwigger describes Repeater as one way to manually verify Scanner issues.
How a typical Burp Suite workflow works
- Route browser traffic through Burp Proxy. Burp’s preconfigured browser sends traffic through the proxy, where the tester can intercept, inspect, and modify messages. Proxy supports HTTPS as well as HTTP. See PortSwigger’s Proxy documentation.
- Set an authorized scope. Use the target-scope step in PortSwigger’s getting-started workflow to keep testing focused on the intended application. Verify that any domains, subdomains, and paths you include fall within the authorization you were granted. See the getting-started guide.
- Investigate a message manually in Repeater. Send an interesting request to Repeater, change a parameter or header, resend it, and compare the response. Repeater also handles WebSocket messages and sequences where the result depends on earlier interaction. See PortSwigger’s Repeater documentation.
- Use Intruder for chosen variations. Select positions in an HTTP request and have Intruder send repeated versions with different payloads. This is useful for customizable, repeated testing such as fuzzing or enumeration. See PortSwigger’s Intruder documentation.
- Run Scanner only when available and appropriate. Scanner can crawl an application to map content and paths, then audit its traffic and behavior for vulnerabilities. It may follow links, submit forms, and use login state, so consider the effect on the target before scanning. Scanner is available in Professional and DAST, not Community Edition, according to PortSwigger’s Scanner documentation.
- Review evidence and report responsibly. Examine the request, response, and issue details; reproduce and validate findings as appropriate, then communicate impact and remediation. PortSwigger’s first-scan tutorial describes the evidence and advisory information available in issue details.
What the main Burp Suite tools do
| Tool | Main role | Typical use |
|---|---|---|
| Proxy | Observe and modify traffic between browser and application. | Capture a request, inspect its headers and parameters, then change it or pass it to another tool. |
| Repeater | Manually edit and resend selected HTTP or WebSocket messages. | Test a changed value, examine a multi-step interaction, or verify a finding. |
| Intruder | Automate repeated HTTP requests with customized payloads. | Put payloads in selected request positions and inspect the different responses. |
| Scanner | Automate dynamic testing through crawl and audit phases. | Map application content and probe behavior for vulnerabilities; requires Professional or DAST. |
| Sequencer | Analyze the randomness of session tokens and other values intended to be unpredictable. | Assess whether generated values appear sufficiently unpredictable. |
| Decoder and Comparer | Decode or encode data and compare two items. | Inspect encoded application data or identify differences between messages. |
For a beginner, the key distinction is the kind of work: Proxy observes traffic, Repeater supports focused manual experiments, Intruder automates chosen variations, and Scanner automates crawling and auditing where the edition allows it. PortSwigger’s tool listing identifies Proxy, Repeater, and Intruder for Community and Professional, and Scanner as Professional. Do not infer from that distinction that it describes every difference between editions.
#1 Best Overall
Does Community Edition include Burp Scanner?
No. PortSwigger’s first-scan tutorial says Scanner is unavailable in Community Edition; its documentation lists Scanner for Professional and DAST. Community Edition still includes core tools such as Proxy, Repeater, and Intruder, but it does not provide the automated Scanner workflow described in that tutorial. Edition features can change, so consult PortSwigger’s current documentation before choosing an edition; these cited pages do not establish current prices, license terms, or every feature limit.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to learn and test safely
Burp sends interactions to a target, and unusual or automated testing can damage systems. PortSwigger advises backing up targets and not using Burp on systems unless the owner has authorized the test or accepted the risk. While learning Proxy’s settings and functionality, its documentation recommends using non-production systems. Do not scan third-party websites without the owner’s authorization. See the cautions in the Proxy documentation and first-scan tutorial.
For hands-on practice, PortSwigger’s getting-started tutorial uses deliberately vulnerable Web Security Academy labs. They provide a purpose-built environment for learning without treating arbitrary live sites as practice targets.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
