Table of contents
Comprehensive Features
Burp Suite offers a wide range of tools such as a proxy server, scanner, spider, repeater, and intruder, enabling extensive security testing.
User-Friendly Interface
The platform provides an intuitive and well-organized interface, making it accessible for both novice and experienced security professionals.
Customization and Extensibility
Users can customize Burp Suite via extensions, allowing them to tailor functionality to their specific needs and integrate with other tools.
Active Community
Burp Suite has a vibrant community that contributes to extensions, plugins, and offers support through forums and other channels.
Regular Updates
The software is regularly updated with new features, bug fixes, and improvements, ensuring it remains up-to-date with the latest security trends.
Yes, Burp Suite is widely regarded as a powerful and effective tool for web application security testing. It is favored by professional security testers and organizations for its depth of features and ease of use.
We have collected here some useful links to help you find out if Burp Suite is good.
Check the traffic stats of Burp Suite on SimilarWeb. The key metrics to look for are: monthly visits, average visit duration, pages per visit, and traffic by country. Moreoever, check the traffic sources. For example "Direct" traffic is a good sign.
Check the "Domain Rating" of Burp Suite on Ahrefs. The domain rating is a measure of the strength of a website's backlink profile on a scale from 0 to 100. It shows the strength of Burp Suite's backlink profile compared to the other websites. In most cases a domain rating of 60+ is considered good and 70+ is considered very good.
Check the "Domain Authority" of Burp Suite on MOZ. A website's domain authority (DA) is a search engine ranking score that predicts how well a website will rank on search engine result pages (SERPs). It is based on a 100-point logarithmic scale, with higher scores corresponding to a greater likelihood of ranking. This is another useful metric to check if a website is good.
The latest comments about Burp Suite on Reddit. This can help you find out how popualr the product is and what people think about it.
The topics will be mostly from Portswigger Website. Also, for some more practical discussion, I'll refer to Kontra. - Source: dev.to / over 1 year ago
There are many tools available for this, e.g. Burp Suite, ZAP, etc. We've evaluated a few and found Probely to be the most comprehensive. They have a trial, so your first few scans will be free. After each scan, you will get a report that includes a list of all findings and a recommendation on how to fix them. You will also get a PCI-DSS and OWASP compliance report. - Source: dev.to / almost 2 years ago
In addition, tools such as snyk or burp can be used to control the dependencies of a project. - Source: dev.to / about 2 years ago
Check https://portswigger.net, they have learning material and labs about this topic. Source: over 3 years ago
I ask about serving websites because understanding how a web server works (very basically) with a browser or any client is a huge step in understanding HTTP, host headers, and even host header attacks (if you're into that sort of thing.. As an aside I did a quick google search and https://portswigger.net/ showed up.. Apparently they have interactive labs and very informative documentation on various attack... Source: almost 4 years ago
As you are quite new to the hobby, I would definitely recommend you go to portswigger.net academy. They give you a quite thorough understanding in all the fundamentals and they have labs set up where you can practice everything you learn at each step. The best part is you can learn at your own pace and it's all free. Source: almost 4 years ago
Connect your PC (with Burp Suite installed) and Android to the same network. > Note โ Here my PCโs IP is 192.168.43.20 and Androidโs IP is 192.168.43.180. - Source: dev.to / about 4 years ago
Web App Security Academy is free through Portswigger. Which is great coverage to learn End-to-End how to find vulnerabilities in a web application yourself. After you get thru that, there's DVWA and Juice Shop... And you can even find these as rooms on TryHackMe if you don't want to self-host it. However, the Web App Security Academy is basically the live-learning environment for the Web App Hackers Handbook...... Source: about 4 years ago
You can get a head start on that class by going through these free tutorials (don't overlook the PDF for each lesson that helps explain what's going on). All of the BHIS pay what you can classes are excellent and an amazing value. TCM is another good choice. To strengthen your understanding of the web and web application security, work through the training from Portswigger.net. There are other resources out there... Source: over 4 years ago
I'm new to this and I started learning about bug bounties last year with hackerone.com and portswigger.net. Now I'm shifting gears and learning about pentesting on tryhackme.com and in the future hackthebox.eu. It looks like bug bounty hunters usually work on a platform like hackerone and get paid per each finding and how severe it is; and pentesters can find work on Linkedin like a contractor and get paid for... Source: over 4 years ago
We are in a similar space, our tool (https://caido.io) is geared toward bug bounty hunters and pentesters. HTTP Toolkit looks great congrats to the dev! It seems to compete more with requestly (https://requestly.io/) than burp suite (https://portswigger.net/). - Source: Hacker News / over 4 years ago
So like BURP Suite(https://portswigger.net/) but with fewer features? - Source: Hacker News / over 4 years ago
IMO, the best place to start would be https://portswigger.net. Their Web Security Academy Learning Path / Labs are by far the best. You can use the free community edition of Burp Suite for most of it. If you're going into web app security then you will likely be using Burp Suite every day anyway. Source: over 4 years ago
Found this useful resource: PortSwigger by looking through this list of NIST resource. PortSwigger offers free learning content and lots of free labs. They don't try to get you to buy anything. They also have videos with each lab to walk you though the steps of completing it if you need help. Source: almost 5 years ago
Select vendors wisely. Heed the words of James Kettle (Director of Research at PortSwigger): > Many companies have subdomains pointing to applications hosted by > third parties with awful security practices. - Source: dev.to / over 5 years ago
Burp Suite, developed by PortSwigger, is a well-regarded tool in the domain of web application security testing. Positioned prominently alongside competitors such as Nessus, Qualys, and Acunetix, Burp Suite is often praised for its robust penetration testing and vulnerability assessment capabilities. However, public opinion on the tool reflects a diverse range of perspectives informed by user experiences, tool functionality, and the broader landscape of vulnerability management software.
Burp Suite is widely recognized for its utility among web security professionals and bug hunters. The tool is celebrated for its comprehensive set of functionalities that are crucial for identifying vulnerabilities such as SQL injections, cross-site scripting (XSS), and other entries in the OWASP Top 10. Users highlight its centralized visual dashboard, which offers a holistic view of scanned activities and discovered vulnerabilities, enhancing its appeal for penetration testers seeking in-depth insights into web application security.
The professional edition's ability to generate extensive reports is frequently noted as a key advantage, providing users with detailed analysis that can be critical in both vulnerability identification and remediation planning. Additionally, Burp Suite's comprehensive user interface is appreciated for allowing nuanced manual testing, a feature that distinguishes it from more automated counterparts.
PortSwigger has invested significantly in educating users through resources like the Web Security Academy. This platform offers interactive labs and extensive documentation at no cost, a feature that is commonly praised in forum discussions. Newcomers to web application security, as well as more experienced professionals, find the learning resources invaluable, particularly as they can practice at their own pace. The academy complements Burp Suiteโs functional offerings by ensuring users have the necessary knowledge to maximize the toolโs capabilities.
Despite its strengths, Burp Suite is not without its criticisms. One recurring point of feedback pertains to its setup process, which users have found to be complex, possibly posing a challenge to less experienced professionals. Additionally, Burp Suite does not automatically verify detected threats, a limitation when compared to some competitors who incorporate automated patching and validation features. This particular aspect may deter users who prefer automated solutions.
In comparison to its peers, Burp Suite's focus is more aligned with manual testing, setting it apart from alternatives that bridge vulnerability management with built-in remediation processes, such as the integrated solutions offered by ManageEngine's Vulnerability Manager Plus. The scrutiny of Burp Suite's manual emphasis underscores a broader industry trend towards holistic, automated security environments that offer patching and misconfiguration management.
In conclusion, Burp Suite is a potent tool within the sphere of web application security, recognized for its comprehensive testing abilities and supportive educational resources. While its setup complexity and lack of automated threat verification may restrict its appeal to a subset of security professionals, its enduring popularity speaks to its efficacy and reliability within the complex landscape of modern web security challenges.
Do you know an article comparing Burp Suite to other products?
Suggest a link to a post with product alternatives.
Is Burp Suite good? This is an informative page that will help you find out. Moreover, you can review and discuss Burp Suite here. The primary details have not been verified within the last quarter, and they might be outdated. If you think we are missing something, please use the means on this page to comment or suggest changes. All reviews and comments are highly encouranged and appreciated as they help everyone in the community to make an informed choice. Please always be kind and objective when evaluating a product and sharing your opinion.
