description Burp Suite Professional Overview
PortSwigger's Burp Suite Professional brings automated web-security scanning together with tools for hands-on investigation. Its intercepting proxy lets testers examine browser traffic, while request-editing tools help them explore how an application responds to changed inputs. Crawling and scanning support the search for vulnerabilities such as SQL injection and cross-site scripting, with findings providing starting points for further investigation. The desktop toolkit suits penetration testers who need to move between automated checks and manual analysis.
Extensions from the BApp Store, along with custom extensions, broaden its capabilities. Authentication and application-logic problems often require a tester's judgment rather than a scanner alone. For centrally managed recurring scans and pipeline integration, Burp Suite DAST is the separate offering to examine.
help Burp Suite Professional FAQ
Can Burp Suite Professional scan APIs for vulnerabilities?
Yes, Burp Suite Professional includes a powerful BApp called the "API Scanner" extension and handles modern REST and GraphQL APIs well. Penetration testers frequently use it to intercept JSON traffic and fuzz API endpoints for injection flaws.
What is the Burp Collaborator used for?
The Burp Collaborator is an external server tool used to detect out-of-band vulnerabilities, such as Blind SQL injection or SSRF. It works by generating unique domain names that the tester can inject into payloads to see if the target server makes an external DNS or HTTP request back to it.
What programming language are Burp Suite extensions written in?
Historically, extensions for Burp were written in Java, Python, or Ruby. However, the newer Montoya API introduced in recent versions strongly favors Java for better performance and stability.
explore Explore More
Reviews & Comments
Write a Review
Be the first to review
Share your thoughts with the community and help others make better decisions.
