PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchBurp Suite is PortSwigger’s toolkit for testing web application security. It places a controllable proxy between a browser and an application, letting a tester inspect and change the messages they exchange. Proxy, Repeater and Intruder support hands-on investigation and repeatable tests; automated crawling and scanning are available in Professional and DAST, not Community Edition. Use it only on systems you are authorized to test.
What is Burp Suite used for?
Burp Suite is a collection of tools for examining how a web application behaves when it receives different requests. Rather than relying only on what appears on a page, a tester can inspect HTTP or WebSocket messages, alter a value, send the message again and compare the response. This helps investigate potential security weaknesses; Burp Suite is not itself a vulnerability and cannot guarantee that an application is secure. PortSwigger’s getting-started guide describes it as a suite for web application security testing.
As an Amazon Associate I earn from qualifying purchases.
The workflow links observation to investigation: capture traffic in Proxy, send an interesting message to another tool, then assess the application’s response. Repeating a test with controlled changes makes it easier to distinguish behavior that depends on a particular parameter, header or sequence of actions.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →How does Burp Suite work?
- Route browser traffic through Burp. Burp Proxy sits between a browser and the target application. Burp’s preconfigured browser routes traffic through the proxy, where requests and responses can be intercepted, inspected and modified. Proxy also supports HTTPS. See PortSwigger’s Proxy documentation.
- Set the authorized scope. Define which application and paths are in scope so testing stays focused on the intended target. Check that any included subdomains or paths are covered by the authorization you have. The getting-started tutorial includes scope-setting in its workflow.
- Investigate a message manually. Send a request or WebSocket message to Repeater, change a parameter or header, resend it and compare the response. Repeater can also handle sequences of messages when a later result depends on prior state. Details are in PortSwigger’s Repeater documentation.
- Repeat chosen variations. Intruder sends repeated HTTP requests with different payloads inserted at positions selected by the tester. This supports customized repeated testing, including fuzzing and enumeration. See PortSwigger’s Intruder documentation.
- Use automated scanning when available and appropriate. Scanner can crawl an application to map content and paths, then audit application traffic and behavior for vulnerabilities. Crawling may follow links, submit forms and use login state. Confirm both edition availability and authorization before using it; PortSwigger’s Scanner documentation describes the tool and its availability.
- Review evidence and report findings. Examine the request-and-response evidence for an issue, reproduce behavior as appropriate, and communicate impact and remediation. Scanner output should be reviewed and validated rather than treated as proof by itself; Repeater can be used to manually verify a finding.
What do the main Burp Suite tools do?
| Tool | Main role | Typical use |
|---|---|---|
| Proxy | Observe and modify traffic between browser and target | Capture a request, inspect its headers or parameters, change it, or send it to another tool. PortSwigger documentation. |
| Repeater | Manually edit and resend selected HTTP or WebSocket messages | Test a changed value, examine a multi-step flow, or verify a finding. PortSwigger documentation. |
| Intruder | Automate repeated, customized HTTP requests | Insert selected payloads at chosen positions and inspect differences across responses. PortSwigger documentation. |
| Scanner | Automated dynamic testing with crawl and audit phases | Map application content and paths, then probe behavior for vulnerabilities; requires Professional or DAST. PortSwigger documentation. |
| Sequencer | Analyze randomness in session tokens or other unpredictable data | Assess whether generated values appear sufficiently unpredictable. PortSwigger tool listing. |
| Decoder and Comparer | Transform data and compare items | Decode or encode application data, or spot differences between two messages. PortSwigger tool listing. |
How are Proxy, Repeater and Intruder different?
- Proxy is for seeing and capturing traffic. It exposes the messages exchanged during browsing and can pass them along for further work.
- Repeater is for manual, focused retesting. You control each edit and resend, which is useful when exploring one request or verifying a suspected issue.
- Intruder is for repeated variations. It automates sending requests with payloads at positions you choose, so you can inspect a set of responses rather than resend each variation manually.
Does Burp Suite Community Edition include Scanner?
No. PortSwigger’s documentation says the automated Scanner workflow is available in Burp Suite Professional and Burp Suite DAST, not Community Edition. Its desktop tool listing marks Proxy, Repeater and Intruder for Community and Professional, while Scanner is marked Professional. These points describe the cited tool availability; they are not a complete comparison of every edition feature. Check the current tool listing and Scanner documentation for current details.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should beginners practice safely?
Use deliberately vulnerable training applications rather than arbitrary live websites. PortSwigger’s Web Security Academy provides labs used in its getting-started tutorial.
Testing can damage a target because it sends unusual interactions. PortSwigger advises backing up targets and not using Burp on systems without owner authorization or without accepted risk of damage. Its Proxy guidance recommends non-production systems while learning the tool’s functionality and settings; the Scanner tutorial warns against scanning third-party sites without owner authorization. See Proxy safety guidance and Scanner guidance.
Quick Recap
Best Value
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems
