Burp Suite Community Edition

Burp Suite Community Edition from PortSwigger is a desktop toolkit for examining how a web application behaves at the HTTP level. It works as a proxy that sits between the browser and the target site, so every request and response can be recorded, read and altered before it continues on its way. The traffic history it builds up is the starting point for most of the work done in the program.

Alongside the proxy it bundles the tools that manual testing usually needs. Repeater sends a single request again and again with modifications so the tester can see how the server reacts. Decoder handles the encoding formats that turn up in parameters and tokens, Comparer highlights the differences between two pieces of data, and Sequencer analyses the randomness of session tokens and similar values. Burp Intruder, which automates the sending of large numbers of crafted requests, is present only in a demonstration form with throttled speed.

The free edition deliberately stops short of the automated features. There is no vulnerability scanner, no crawler, no out-of-band testing support and no content discovery, and work cannot be saved to a project file, so a session ends when the program closes. Those capabilities belong to the paid Professional edition, which is a separate product.

It suits people learning web application security, students working through hands-on exercises, and developers who want to see what their own application actually sends over the wire. It is not a fit for anyone who needs unattended scanning, repeatable engagements saved across days, or a report at the end. The program requires a Java runtime, which the installer supplies, and it should only be pointed at systems the user is authorised to test.