What Is Burp Suite? How Pen Testers Use It

Written by Ruben Selby, Founder and Lead Security Consultant, Wolfcore. Last reviewed 7 November 2026.

In one sentence: Burp Suite is a software toolkit that sits between a web browser and a website so a security tester can see, pause and change the traffic, to find weaknesses in how the site handles it.

Part of our Security tools library.

What Burp Suite is

Burp Suite is made by PortSwigger, the same company that runs the free Web Security Academy. Its documentation describes a wealth of features that support manual and automated security testing of websites.

It comes in editions. Burp Suite Community Edition offers manual tools. Burp Suite Professional is the toolkit for penetration testers and adds features marked “Pro only” in the documentation, including the automated scanner and a service called Collaborator. A separate product, Burp Suite DAST, is aimed at automated scanning.

Burp is a tool, not a method. It does not decide what matters. A tester does. That is why a scan from any tool is not the same as a penetration test.

How it works

The core idea is an intercepting proxy.

The tester points their browser at Burp, so every request goes through it first.
Burp records each request and response in a history, building a map of the site.
The tester sets a scope, so only the systems they are authorised to test are touched.
They pause a request, change something in it, then send it on.
They resend the same request many times with small changes, and study how the server reacts.
They note what the application does wrong and write it up with evidence.

PortSwigger’s quick-start steps follow this order: install, intercept HTTP traffic, modify requests, set the target scope, reissue requests, then (Pro only) run a first scan and generate a report.

What the main tools do

From PortSwigger’s tool list, in plain English:

Proxy: captures traffic and lets the tester pause and edit it.
Target and site map: records the pages and functions found, and the scope.
Repeater: resends one request again and again with changes.
Intruder: sends many variations of a request automatically, for tasks like checking how a site handles different inputs.
Sequencer: checks how random session tokens really are.
Decoder and Comparer: decode strange data and compare two responses.
Scanner (Pro only): automated crawling and checking.
Collaborator (Pro only): helps spot problems where the site makes an outside call that is not visible in the page.
Engagement tools: helpers for testers, including a generator for cross-site request forgery proof-of-concept pages.

PortSwigger’s documentation also warns that, like any security testing software, Burp can damage target systems, and should not be used against systems you are not authorised to test. That is why scope and written permission come first.

Who it affects and how badly

Burp itself is not a threat to you. It is used by the people you hire to test. What matters is what it finds, such as the problems in how-sql-injection-works and how-csrf-works.

The same category of tool can be used by an attacker, because intercepting proxies are freely available. That is the point of testing first.

Sole trader to 10 staff: your site is probably a plugin or template. Ask the supplier what testing it has had.
10 to 250 staff: a custom portal or SaaS product should be tested by a person at least before major releases.
Regulated and 250 plus: testing is usually something clients, insurers or regulators ask to see evidence of.

Worked example (an illustration)

A 12-person estate agency has a custom portal for landlords. The agency hires a tester. The tester proxies the portal through Burp, finds that the “change bank details” request has no protection token, and shows the agency with a saved request and response. The agency adds a token and SameSite cookie settings, then asks for a retest. The cost is the test fee and a developer’s day. The alternative is a landlord’s payout going to the wrong account.

What we check on a test

Intercepting proxies like Burp are the standard workbench for web testing. Our method is the same whichever tool is used, and it is manual: a person decides what to try.

Map every page, function and API call, including ones the interface hides.
Test each input for injection, using careful checks agreed in scope.
Test login, session and password reset handling.
Test whether one user can reach another user’s data.
Check that state-changing actions carry protection against forged requests.
Record each issue with a request and response, a plain explanation and a fix.

How to detect testing, or a tester’s traffic

Agree a test window and source IP addresses with your tester, so you can tell them from real attackers.
Expect large numbers of requests to one site from a single address, with edited parameters.
Check that web server logs, application logs and any web application firewall alerts are being kept, and that someone reads them.
Watch for errors that reveal internals. Testers see these in seconds.

How to get value from a test

Define the scope in writing: sites, APIs, accounts and test dates.
Give the tester logins for each user role, so they can test what a logged-in user can reach.
Test a staging copy first if you worry about damage, as PortSwigger warns tools can cause problems on fragile targets.
Fix what is found, then retest.
Keep the report for clients and insurers.

FAQ

Is Burp Suite free? PortSwigger offers a Community Edition with manual tools, and a paid Professional edition with extra features such as the scanner.

Does running Burp make someone a penetration tester? No. Burp is a tool. The method and judgement come from the person using it.

Is it legal to use? Only against systems you have permission to test. PortSwigger’s documentation says not to use it on systems you are not authorised to test.

Sources

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan at https://wolfcore.co.uk/free-web-vulnerability-scan/ or see our web application testing at https://wolfcore.co.uk/services/web-application-penetration-testing/.