It can be used to test an application’s session tokens or other important data items that are intended to be unpredictable, such as anti-CSRF tokens, password reset tokens, etc.Comprehensive suite of tools intended to test the security, functionality and vulnerabilities of network and web applications.īurp Suite is a comprehensive suite of software tools designed to provide security testing of web applications.

Sequencer – A tool for analyzing the quality of randomness in a sample of data items.

Extender – Allows the security tester to load Burp extensions, to extend Burp’s functionality using the security testers own or third-party code (BAppStore).

Comparer – A tool for performing a comparison (a visual “diff”) between any two items of data.

It is capable of intelligently recognizing several encoding formats using heuristic techniques.

Decoder – A tool for transforming encoded data into its canonical form, or for transforming raw data into various encoded and hashed forms.

It can be used to modify requests to the server, resend them, and observe the results.

Repeater – A simple tool that can be used to manually test an application.

It can be used in conjunction with manual mapping techniques to speed up the process of mapping an application’s content and functionality.

Spider – A tool for automatically crawling web applications.

Intruder – This tool can perform automated attacks on web applications. The intruder tool can test and detect SQL Injections, Cross Site Scripting, parameter manipulation and vulnerabilities susceptible to brute-force attacks.

Scanner – A web application security scanner, used for performing automated vulnerability scans of web applications.

This allows the interception, inspection and modification of the raw traffic passing in both directions.

HTTP Proxy – It operates as a web proxy server, and sits as a man-in-the-middle between the browser and destination web servers.In addition to basic functionality, such as proxy server, scanner and intruder, the tool also contains more advanced options such as a spider, a repeater, a decoder, a comparer, an extender and a sequencer. It was developed to provide a comprehensive solution for web application security checks. The tool is written in Java and developed by PortSwigger Security. The free version has significantly reduced functionality. Burp or Burp Suite is a graphical tool for testing Web application security.

Burp suite professional download free