Burp Suite Reviews

“One of the strongest web app testing tools”

Pros

This is one of the strongest tools available for web application security testing.

Cons

The interface can be hard to navigate, feels comfusing in places and it can put a heavy strain on system performance.

“advanced pentesting capabilities”

Pros

For us, Burp Suite is the tool we rely on most for web application penetration testing. It's very user-friendly while still offering advanced capabilities. The automated testing and the assessment results are excellent and the ability to customize it and add Burp extensions makes the testing process even more powerful.

Cons

There aren't any major drawbacks with this product although automated scans can be resource-intensive. It also takes a highly skilled professional to use the product effectively.

“Strongest platform for appsec research and labs”

Pros

Hands down, this is the strongest platform available for application security research papers and hands-on labs. Anyone planning to build a career in appsec should really go through all of the PortSwigger labs and articles.

Cons

Every now and then the lab environment throws odd errors that can take quite a while to troubleshoot.

“the best resource I have come across”

Pros

The Web Security Academy is packed with thorough, hands-on web penetration testing courses and is honestly one of the best resources I've come across. The fact that all of it is available for free makes it even more impressive. Burp Suite is also the go-to tool for web penetration testing and easily one of the most recognized names in the field.

Cons

I don't have anything negative to say about PortSwigger.

“build your own modules”

Pros

I would say this is a Swiss army knife for me and has saved me a lot of time during web application testing and pentests. The site also offers plenty of resources that make it easier to learn how to use Burp Suite properly. On top of that, it's possible to build your own modules for specific tasks which is really helpful.

Cons

It hits a negative point when it comes to the cost. A one-year Burp Pro license is fairly expensive at nearly $450 per year and the classic Enterprise edition is on another level at around $19,121 annually.

“Burp Suite is one of the best scanners”

Pros

Beyond the course materials and labs on the learning platform which stay current with the latest developments in web application security, PortSwigger's flagship product, Burp Suite, stands out as one of the best tools available for analyzing and scanning web apps.

Cons

Academy lab solutions are not explained in enough detail.

“Proxy interceptor stands out to me”

Pros

For any penetration tester this is essential and the fact that it can run on almost any type of system makes it even more practical. One of its biggest strengths is the proxy interceptor which lets you inspect and manipulate traffic very effectively.

Cons

The interface still needs improvement in future releases since it could be much more user-friendly and overall a lot better.

“their menu has everything I need”

Pros

Pretty much everything I need is available from the right-click menu, including any newly added extensions which makes working with it really convenient. The standout feature for me is the proxy tool since it captures everything happening across the network.

Cons

One thing I still can't figure out is why the render tool isn't supported properly in my Kali VM. I'm on the latest version of both Kali and Burp but the rendering feature still doesn't behave the way it should.

“Flexible enough to work your own way”

Pros

Compared with many other web assessment tools, Burp Suite offers a very competitive price while still packing in a wide range of features. The Community Edition is more limited than the Professional version but the overall toolkit is still simple and flexible enough to carry out tests efficiently. Unlike some other web application testing tools, Burp Suite gives pentesters plenty of room to work the way they want and tends to produce fewer false positives.

Cons

This is definitely not a point-and-shoot tool so it takes solid in-depth knowledge to run a proper penetration test. Although it includes a lot of built-in tools, they need to be organized better within the interface. The UI also feels a bit outdated and could use improvement. On top of that, there are not many learning videos available for beginners, support feels somewhat limited and the reporting side needs stronger, more comprehensive templates.

“Active scanner evaluates security thoroughly”

Pros

Burp Suite Professional does an excellent job of evaluating application security and uncovering vulnerabilities. It comes with a very capable set of pentesting features and the active scanner is especially useful for checking the security of web and mobile applications. The Repeater and Intruder tools are my favorite parts because they let you run through many possible test cases on input parameters quite efficiently, then review and report the findings either inside the tool or in a regular browser.

Cons

It's very effective at identifying most vulnerabilities in an application but the active scan can occasionally produce false positives. Because of that, manual verification is still necessary especially when dealing with critical issues such as SQL injection or XSS.

“must have tool for network security work”

Pros

To be honest, this is like a core tool for anyone working in network security, with a massive range of useful features built in. Once you add extensions, it can also automate tasks and scan for a wide range of common vulnerabilities. All in all, Burp saves a lot of time and really belongs in the toolkit of any security analyst or tester.

Cons

The pricing for the paid version is fairly steep although it's not absolutely required if you can work within the limits of the community edition. It's also a shame that many of the best community extensions are locked behind the paid tier.

“Makes work much easier”

Pros

Very user-friendly, with advanced features that make a pentester's work much easier.

Cons

Honestly I haven't come across anything I dislike about Burp Suite.

“Pro version adds helpful automation”

Pros

Even with a bit of technical knowledge needed, the GUI makes it approachable for almost anyone to begin building their own tests. PortSwigger also provides plenty of documentation to help you get started and safely test your own sites. On top of that, there are many plugins available that make the process more convenient and help uncover more results. If you go with the Pro version, it adds useful automation features for testing. That said, the results still need to be reviewed carefully since false positives can happen.

Cons

At times, the proxy installation does not work on the first attempt and the troubleshooting guidance is not very clear about how to fix the issue.

“Covers a wide range of vulnerability tests”

Pros

Both Burp Suite Professional and Enterprise are among the top tools out there for website vulnerability scanning. As the lead application security reviewer, part of our process is to run vulnerability testing on every website our developers update before anything goes live to production. Burp Suite has been a very reliable option for handling these checks. It covers a wide range of vulnerability tests and it can also be configured to run custom tests that are not included out of the box.

Cons

Burp Suite is reasonably manageable once you get into it but getting started can feel a little intimidating at first. The good thing is that if you spend some time with the online tutorials, it becomes much clearer how to run it properly.

“Free version is surprisingly capable”

Pros

There are tons of features packed into this tool, including a surprisingly capable free version. The interface can feel a bit confusing at first but once you understand where things are, locating what you need requires no hunting around. The two standout features for me are capturing requests and replaying them which makes fuzzing much more convenient.

Cons

Although it is supposed to capture WebSockets, I wasn't able to get that working though I've heard that may have been fixed. Accessing the certificate page can also be a little inconsistent at times.

“Repeater and Intruder are incredibly useful”

Pros

Burp Suite feels like the top man-in-the-middle tool out there for web penetration testing and exploit development. It gives you a ton of control over everything happening in the process and features like Repeater and Intruder are incredibly useful. Absolutely love using it.

Cons

That said it's not really a tool for someone who isn't fully committed to the work or the objective. The price is pretty high, at least from my perspective and I definitely had a hard time learning how all of its functionality worked in the beginning.

“solid backend visibility”

Pros

A key feature that really stands out is the very simple, user-friendly interface. It also helps us understand the backend workflow of web applications and it comes with plenty of features to carry out penetration testing whenever needed.

Cons

Burp Suite has been a really solid tool overall. At this point, I haven't come across any bugs or other issues worth mentioning.

“Manual and automated testing combined well”

Pros

It has been really useful for penetration testing our applications and uncovering security loopholes. It comes with a large set of both manual and automated tools that help identify and eliminate weaknesses in an application's security. Among its most valuable and widely recognized features are Spidering and web prompting. These let us first map the full application architecture in one go and then test different combinations either manually or through automated scripts.

Cons

There are so many features in the tool that some of them end up buried in the options which makes them hard to discover and use properly. It also falls short when it comes to online help or official video content that could make it easier for beginners to understand how everything works. The application's GUI could use some improvement as well especially to make the available features more visible and easier to access when needed.

“Highly customizable scanning and attack features”

Pros

Why BurpSuite stands out as one of the strongest toolsets is for web penetration testing. It includes web vulnerability scanning and offers highly customizable scanning and attack features which makes it very capable for thorough security testing.

Cons

Getting started with it can be challenging but thankfully there are plenty of tutorials available online that help beginners learn how to use BurpSuite.

“Interceptor is flexible”

Pros

The tab-based layout in BurpSuite makes it much simpler to keep track of everything you're doing. The interceptor is also very direct, flexible and simple to work with. Another feature I really appreciate is being able to define scopes, including multiple scopes at once, along with the option to set brute-force fields in several different ways.

Cons

The part I liked least is the vulnerability scanner since it does return some false positives. Source code review also feels a bit cluttered and once you have a lot of sitemaps open, it becomes pretty confusing and hard to navigate.