Burp Suite

Burp Suite is a toolkit for testing the security of web applications, used by penetration testers and application security engineers. At its core is an intercepting proxy that captures HTTP(S) and WebSocket traffic between a browser and a target server, letting the user inspect, replay and modify individual requests. Around this proxy sit a set of manual testing tools: Repeater for resending and tweaking requests, Decoder for encoding/decoding data, Sequencer for analyzing token randomness, and Comparer for diffing responses.

The free Community edition ships these manual tools along with basic request history logging, aimed at people learning application security or doing lightweight manual testing. The paid Professional edition adds an automated vulnerability scanner, a full (rather than rate-limited) version of the Intruder tool for automated attack payloads, project file saving, content-discovery crawling, and out-of-band (OAST) testing support, positioning it for professionals who test applications as part of their job. A separate enterprise product, Burp Suite DAST, targets organizations that want scanning integrated into a broader development pipeline.

Burp Suite is suited to people who already understand HTTP and want direct, low-level control over requests during security testing, rather than a fully automated set-and-forget scanner. It is not a general-purpose network tool or VPN; its scope is specifically web application traffic and vulnerabilities.