PortSwigger

“It is an excellent intercepting proxy with tools to manually inspect and modify requests.”

“Burp Suite has allowed me to analyze and attack request traffic more efficiently and effectively than other "enterprise" web scanners or automated pentest tools.”

“If I can do this with almost no technical background, imagine what you could do if you've actually studied Computer Science.”

“Just finding one bug pays for the Burp Suite Pro license fee.”

“The amount of time you need to invest in order to learn Burp Suite is very small - because it doesn't involve code like other tools.”

“"Burp Suite DAST frees our AppSec team to spend their time where it's most valuable."”

“The goal was never to replace people,” White concludes. “It was to remove the frustrating time, so our testers can spend more energy on the fun stuff—the hard problems that actually matter.”

“The magic is this wasn’t a separate AI tool we had to teach about our tooling. It was built into Burp, using the same context, the same requests, the same workflow our testers already know and use”

“Using Burp AI on just two or three standard engagements pays for the annual uplift”

“I would be surprised if all penetration testers are not exclusively using Burp Suite… [at Microsoft] it’s not even up for consideration. Burp Suite is what you use.”

“At Microsoft, Burp Suite is what you use. It’s not up for consideration.”

“PortSwigger’s guided onboarding gave us confidence to start small, get hands-on experience, and then plan for scale once we were ready.”

“Burp Suite DAST gives us the ability to quickly find exploitable issues across our external applications, so we can focus on reducing risk rather than chasing noise.”

“I want developers to be able to run DAST alongside SAST. That way, the low-hanging fruit gets caught automatically — and pentests can focus on real issues.”

“It kind of hides the difficult stuff but still makes it available if you want to get into something really advanced.”

“The customizability and extensibility is really helpful if you're testing a target that has a different tech stack, there are extensions you can grab that are specific to that. Burp doesn't make it cumbersome like a lot of other software.”

“Collaborator is a huge one. I use it a lot. It's super helpful to be able to quickly see if there's an SSRF vulnerability in the background, where the app will make a request to any URL you provide.”

“Intruder is really helpful for this because it means I don't have to spend hours setting up a whole Python script, which may not even find anything. It's really nice to just be able to go 'Here is a list of 100 things to try' and just run through them real quick without having to worry about it too much.”

“The Repeater is definitely my number one tool. It lets me take a request and test what happens if I modify it in a particular way. This helps me to almost see under the hood of the application. That's pretty huge.”

“Rather than me having to enter all that data manually and describe which parameter is affected and how, Burp is very good at saying 'it's this parameter, and here is the evidence.’”

“The new ‘hide uninteresting headers’ option is great for that, especially now that we're able to customize the list to include our own headers.”

“Usually I send the request to Repeater, edit it into the simplest form I possibly can, and then I take its URL into our reporting tool and build a proof of concept.”

“I love the Burp Scanner. It's probably my number one feature. It means I can focus on the manual testing and the stuff that I know the scanner can't do.”

“I hate manual fuzzing and having to come up with test cases based on what I have in my notes.”

“What I really love is that, while I'm walking around the application, I can say 'oh, that's a cool endpoint!' then send it to Param Miner or run more targeted scans straight away. I know that's just happening in the background while I do more recon. I love all that.”