PortSwigger Burp Suite Professional Reviews

I have used the Intruder tool in PortSwigger Burp Suite Professional at least once or twice. It is used to fuzz parameters or brute force login. I think I used it once. I don't remember if it gave me results, but at least I had a good tool to use. It's a tool that automatically uses different payloads for something specific, and it is good.

The Repeater tool is the bread and butter of my work. This is how we work. We use the proxy, then we stop, we interrupt it, and then we get a message with a request that has a response. We want to check it, so we use the Repeater. We take it, change one little thing, and send it again. Then we change it a little, and send it again. I've used the Repeater repeatedly. The Repeater is the bread and butter of PortSwigger Burp Suite Professional.

I've run the Scanner feature in PortSwigger Burp Suite Professional once or twice. However, for finding vulnerabilities in an automatic way, I use ZAP. I used to work with ZAP, OWASP ZAP, an automatic vulnerability scanning tool that is freeware. When I worked with Fiddler, I did the proxy work with Fiddler and the automating attacks with ZAP. Fiddler, in those days at least, perhaps still now, didn't have anything automatic. PortSwigger Burp Suite Professional, at the beginning, didn't have it, and eventually, it added this possibility. I think it's been there for a couple of years, but at the beginning, it didn't have it. Even though I started working with PortSwigger Burp Suite Professional, I think I may have run the Scanner once, but I prefer to run ZAP because I'm more used to it and I think it checks many more vulnerabilities. ZAP has a lot of add-ons. For the Scanner, I use ZAP.

Whenever I need to run something automatic, I use ZAP. I always use ZAP. I think I used the Scanner in PortSwigger Burp Suite Professional once, but not a lot. Perhaps I should do it again because I haven't done it lately; perhaps they made it better. I was so used to running ZAP that for this part of the proxy work I use PortSwigger Burp Suite Professional, but for the automatic, I use ZAP.

One of the best things in PortSwigger Burp Suite Professional is that it has its own browser. It brings it up and it has its own browser. Fiddler uses either Chrome or Firefox or Edge or whatever it is, and Fiddler works with it together in a very good way. However, lately, I've noticed that I have problems with HTTPS sites that have a way of securing them against proxy attacks. I wasn't sure how Fiddler works with it. On the other hand, in PortSwigger Burp Suite Professional, there's no problem because it has its own browser, so it knows how to deal with it. That's one good thing, and I've been working on and off because I'm not a full-time penetration tester, just part-time, but I have used PortSwigger Burp Suite Professional in the last year or so quite a few times. I've worked on four or five projects.

I didn't use the customized test configurations in PortSwigger Burp Suite Professional; I used the default configuration. I'm not a truly expert on it. I used the configuration, but I know and I have used at least one add-on. PortSwigger Burp Suite Professional has add-ons. There's a special one for JWT attacks, a JWT token. Configurations I've used are the standard. What is good in PortSwigger Burp Suite Professional that I don't remember it having in Fiddler is that it has projects. I can say I can work on different projects, especially if I have Burp Pro, I can define, if I work on two things, two projects, then I don't get mixed up. I can divide the work into projects and keep each project separate. That's a very good thing.

I'm hoping perhaps for something to make it easier, such as to define things where if a message or a response is such and such, automatically make a request that is such and such. Perhaps something like this because otherwise, nowadays we have to do it manually. Perhaps they can automate it a bit more. Perhaps they could add some automation to things, to see what we do manually, which it has the tools to do manually, and perhaps enable with a click of a button to do things automatically. I'm not too sure which, but I'm sure they can from a product management point of view, do things that we need to do two, three, or four steps manually regarding specific testing. For instance, we want to check something specific if it's this or if it's that. Perhaps to define it once and have it more automatic, perhaps.

I've been working with PortSwigger Burp Suite Professional on and off for about a year or a maximum of two years.

In my current company, I've been working for the last five years. Before that, I worked another 10 years in another information security company, and there I was nearly a full-time penetration tester. Although in the previous company, I did look at PortSwigger Burp Suite Professional and worked a bit, I mostly worked with Fiddler. In this company that I'm working on, I again started with Fiddler, but I moved on to PortSwigger Burp Suite Professional for the last, say, two years.

I am not working with Fiddler for nearly two years because most of the things I have to test are HTTPS, and I haven't managed to get it working. Perhaps it's my problem, but on the other hand, it is good because it forced me to start working with PortSwigger Burp Suite Professional, which has a lot of good possibilities for using a lot of good options for doing tests. It forced me to learn a very good product. Before that, I was using Fiddler, which is good, but PortSwigger Burp Suite Professional is superior in quite a few options.

PortSwigger Burp Suite Professional perhaps can reach the level of all the various attacks that ZAP does. They do have the basic set. I don't think they have everything. I don't think they have all the various attacks and at least not all the various combinations of attacks. In that case, ZAP is better in the scanner. For APIs, when I want to look at them, change things, and test, I like the Postman user interface for APIs. Perhaps PortSwigger Burp Suite Professional can get a bit better, although I can check the APIs in PortSwigger Burp Suite Professional using the Repeater. I check APIs with Repeater, but Postman has some GUI options that make it a bit more understandable, at least for beginners. They may want to take a bit of the GUI from Postman and use it for API testing or some parts of it to make it simpler to understand what's happening there. However, from a functionality point of view, I do look at Postman to understand and check things, but for actual testing projects, I use the Repeater. The developers use Postman, and it is good that we get the Postman files and use them to understand the structure and everything of what happens with the APIs. I test it using Repeater. Perhaps to get some ideas from Postman would be good for the APIs.

I haven't used a lot of BApp Store extensions, but I found that the JWT attack extension was a good extension. I saw my colleague used that Turbo Intruder extension. That's what my colleague used. This makes it much better for different payloads, for attacking. It's an extension. I saw him use it. I haven't used it, but I saw that he was very happy with it.

I think the pricing for PortSwigger Burp Suite Professional is reasonable. I don't remember the price, but at the place where I work, we needed four or five licenses and we asked management, and they didn't have any problem with it. The price, although I have to pay every year, is very reasonable. Especially if I take it into account that perhaps not now, but at my previous work, I was a penetration tester and did about 30 or 40 penetration tests a year. Each one took a week or two weeks. I was constantly working with a proxy tool. If I take PortSwigger Burp Suite Professional and someone who's working not around the clock, but nearly every day and is a penetration tester who works every day, in another team that I'm kind of part of, there are people there who work more as penetration testers. I do a bit of consulting, so I don't do it all the time. However, they do it all the time, and they work with PortSwigger Burp Suite Professional all the time. For a tool that people work with all the time, and it is their main tool for application testing, penetration testing, vulnerability scanning, and finding things of this nature, I think the price is quite reasonable.

The price is reasonable. I would rate my overall experience with PortSwigger Burp Suite Professional as a 9 out of 10.

My main use cases for security testing with PortSwigger Burp Suite Professional are mobile application penetration testing and web application penetration testing in the IT industry.

I find all the features of PortSwigger Burp Suite Professional most useful, particularly the AI enhancement for results and follow-up for retests.

This feature helps me follow up on my results and perform retests step-by-step. The automation in AI verifies the findings, ensuring they are correct, and performs step-by-step testing.

The Intruder tool enhances testing efficiency through intercepting information and analyzing it. It helps to analyze web applications and intercept the traffic.

The only potential improvement would be adding Postman integration specifically for APIs.

I have been working with the tool for five years.

I haven't experienced any issues with stability; it is a stable solution.

They have an option for enterprise for scalability, but I currently use just a single license.

My environment is medium-sized, and I am the only user of this tool.

Before working with PortSwigger Burp Suite Professional, I evaluated other tools for testing such as OWASP ZAP.

PortSwigger Burp Suite Professional offers benefits because it's not open source, providing extra features such as AI enhancements that are not available on OWASP ZAP. OWASP ZAP is completely free.

The setup process for PortSwigger Burp Suite Professional is quite easy. I would rate the setup a nine on a scale from one to ten, where ten means easy.

Deployment takes approximately two minutes.

The cost of PortSwigger Burp Suite Professional is reasonable at approximately $500 per year per user.

As a user and customer, I can say that PortSwigger Burp Suite Professional is a good tool that performs its intended functions effectively. It operates as an interceptor and analysis tool, completing its tasks reliably.

On a scale from one to ten, I rate PortSwigger Burp Suite Professional a nine.

We use Burp Suite Professional for testing websites and checking some servers, primarily scanning IP addresses and checking which ports are open.

Burp Suite Professional saves time by allowing us to set up scans and then review the results later.

The most valuable feature of Burp Suite Professional is its ability to schedule tasks for scanning websites, which helps in performing regular checks of IP addresses.

It would be beneficial to have privileged access management as a part of Burp Suite Professional.

We have been using Burp Suite Professional for approximately one year.

Burp Suite Professional is stable as we keep it up to date, and it does not have issues.

Burp Suite Professional can be scaled effectively.

The technical support from PortSwigger is excellent, managing response time and quality efficiently without any issues.

Positive

I have experience with Nessus, which is slightly cheaper. It is used for scanning externally, whereas Burp Suite is better for internal scanning.

The initial setup of Burp Suite Professional was simple and completed by myself. It took about one hour, while the configuration took approximately three hours.

The setup and implementation of Burp Suite Professional were handled by myself without requiring third-party consultants.

The pricing for Burp Suite Professional is not very high, however, it could be more flexible for clients.

I use Nessus for some tasks because it is a bit cheaper and better for external scanning.

I would recommend Burp Suite Professional to other users as it is a beneficial tool.

I'd rate the solution nine out of ten.

We use this solution for security testing, and application security.

We are basically a service provider, so whatever application goes out of our office, we use this to ensure that it is covered from an application security standpoint. So we run it using the tool and scan the application. That's what majorly we are using Burp Suite for. But not only that, we can even run manual test cases by playing with the tool. So, we are using it extensively.

We are mostly using it for scanning the entire website. So, we basically create a script with the entire website and then run it for different injections.

And then get the results and analyze those results using the manual options available in the suite. And then, basically, close up.

So, in general, we find value in scanning features.

We have found that so many times, false positive bugs are there, and then we spend a lot of time basically separating them from real bugs. So that's the reason we are looking for some other tool. So we were in discussion with Acunetix.

Therefore, the false positive rate is, like, something that we would like to improve.

What we are looking for is if this false positive rate goes down because we were OWASP Zap tool users, which was free anyway. But there were a lot of false positives there, and we used to spend a lot of time, like, for security reasons, reproducing those bugs for the development team to fix it. 

So then we thought, okay, why not we go with the tool? Even if it is not very expensive. But still, every year, we have to renew the license. And we got this tool. Again, we found that in this tool also, even if it is less, there are still a lot of false positive bugs out there. So we again have to spend so much time. 

So we hired a security tester, who was basically using Acunetix in his previous company for almost three years, and then you said that in that scanning is very slow. The scanning is also slow. Like, sometimes the site scan takes eight hours, six to eight hours. Yeah. And whereas in Acunetix, it took three to four hours.

And plus, there are no false positives. I'm not saying none but there's very little. But here, the rate sometimes is very high. These are the two features I think we would like to improve further.

I have been using this solution for almost three years now. We recently got the license renewed so we are using the latest version. 

I would rate the stability an eight out of ten. 

It is scalable. I would rate the scalability a six out of ten. We have one license.

Because one scan takes six to eight hours, so probably, use it 40 to 50 hours a week.

The support is not very quick in answering, but they do answer. So, I would like them to be faster. 

Neutral

We previously used OWASP Zap before moving to PortSwigger. Acunetix was very expensive, so the organization was not ready to spend that much. And Veracode was not competitive at that time because it was basically more for code scanning, not for the application, black box scanning. So we were looking for something which was a black box scanning kind of our solution. So we figured out that Burp Suite is good. Plus, one of our customers also recommended us to use that tool, and we had a license version from him to use it for their project. So we also had experience there. So that's why we moved to this solution, and more about the price-wise also it's very nominal.

I would rate my experience with the initial setup an eight out of ten, where one being difficult and ten being easy to set up. It is easy. It's not that difficult.

My IT team does the deployment. The deployment took only 10 to 15 minutes. It was really fast. 

We just get a new license and then pass that license key to the IT team, and then, basically, they set it up. One person was enough for the deployment and no one required maintenance. If we have any problem, we normally send a message to the PortSwigger team. We have queries, but no problems.

We already have a WebSpots Professional License. We bought directly from the website. We just got the license renewed because it's an annual license.

We have one license. The price is very nominal. 

I would rate the pricing a four out of ten, where one is cheap, and ten is expensive. There are no additional costs to the standard license. 

I would say if price-wise you are looking for a good solution, then Burp Suite is the solution. But, obviously, if the price is not a reason, then I would rather like them to go to Acunetix.  

PortSwigger is definitely much better than OWASP Zap. It's easier to use, but you end up spending time. Like, my security personnel had to spend almost more than half a day to just analyze those bugs and then create a report for the development to fix it. And separate all those bugs, which are not even bugs, right, and figure it out and it takes time.

Overall, I would rate the solution a seven out of ten.

We use PortSwigger Burp Suite to scan our internal banking journey. Where we have customer-based applications in the banking industry, we test performance and security to catch defects as easily as possible. That is why we use PortSwigger Burp Suite.

The solution scans web applications and supports APIs, which are the main features I really like. It is also user-friendly. We only have to integrate the proxy and give a URL, and then the solution starts intercepting and scanning all the pages of our application.

The solution is very user-friendly and easy to use. Once you start using it, you will understand everything because the details they have mentioned are super informative.

From a security perspective, I have only found defects related to cookies. It would be good if the solution could give us more details about what exactly is defective, and it would be more helpful if it explored more to catch as many defects as possible, apart from cookie-related defects.

I have been using PortSwigger for six months as a customer. I have experience with the different plugins used in Burp Suite, such as J2EE.

The solution's security features need to be improved. If the solution could catch more security-related defects apart from cookie-related defects, it would be a more powerful tool, and people would definitely not consider any other tool.

The solution is easy to scale. Six people are using the solution within my team, and my organization plans to give the license to all the QA testers.

PortSwigger Burp Suite is very easy to install. We can even integrate plugins into automation, so the configuration is easy. The solution takes five to 15 minutes to deploy and set up.

We only need one architect to deploy the solution. You don't have to take any support from other teams. They give you the exe. If that installation is ready, then you just have to click and click on "next." You don't require anyone's help to install the solution on your machine. You can do it by yourself. PortSwigger Burp Suite does not require maintenance.

PortSwigger is a bit expensive, but it has many features and many credentials. A bank could afford this solution.

I have not found many defects in my application of the solution. However, I'm unsure whether the application is very stable and has no security issues, or if the tool we are using is not catching any defects.

The solution is user-friendly, and we can perform security testing, so I recommend the tool. It is very easy to understand, requires less maintenance, and you don't require any support since installation is very quick. I rate the solution a seven out of ten.

I use PortSwigger Burp Suite Professional for penetration testing.

Burp has strong suite features. I especially value the features for penetration testing.

There is room for improvement in composition and improvements could be made. Some AI features might be added.

I have been using Burp Suite Professional for six years.

PortSwigger Burp Suite Professional is very stable, even more so than Aquentix, which is ninety-eight percent stable.

The support from PortSwigger is passable.

Positive

Installation of Burp Suite is easy, and one person is enough to conduct it.

Maintenance is not needed here; it is all automatic.

The pricing for PortSwigger is very cheap, and there are benefits in terms of time and cost savings.

I rate PortSwigger Burp Suite Professional ten points out of ten.

We use the solution for security assessments. It's a special tool for penetration testers or security specialists.

PortSwigger Burp Suite Professional is a standard tool in the security industry. It's a stable solution that has many features. You can download different plugins if you don't have them in the standard edition. You can also write your own plugins if you know how to do it.

The solution’s pricing could be improved.

I have been using PortSwigger Burp Suite Professional for more than five years.

PortSwigger Burp Suite Professional is quite a stable solution, and I don't remember it crashing too much.

I rate the solution an eight or nine out of ten for stability.

PortSwigger Burp Suite Professional is not a cloud solution. Since you have to download it to every machine you use, it's not scalable at all. Around seven users use the solution in our organization.

We have previously used a free, open-source solution called OWASP ZAP. Since PortSwigger Burp Suite Professional is the standard in the industry, it's much better than OWASP ZAP.

The solution's initial setup is straightforward. You just have to download, install, and use it.

You have to download the solution from the internet. You can download the free version or the community edition. If you have a license, then you can download the professional version, install it, enter your license, and then use it. It takes around one minute to deploy the solution.

PortSwigger Burp Suite Professional is totally worth it.

We pay a yearly licensing fee for the solution, which is neither cheap nor expensive.

PortSwigger Burp Suite Professional is a great product for people who need security features.

Overall, I rate PortSwigger Burp Suite Professional ten out of ten.

The Repeater and the BApp extensions are particularly useful. Certain extensions, such as the Active Scan extensions and the Autoracer extension, are very good. 

The crawling functionality has improved, but I would say that in the past, the spider mechanism was more efficient than the current crawling method. 

Generally, I don't rely solely on the Burp Scanner, but I utilize BApp extensions to achieve better results than the standard scanner. Mostly, I always rely on external extensions, specifically those that provide better results.

I would like to see the return of the spider mechanism instead of the crawling feature. Burp Suite's earlier version 1.7 had an excellent spider option, and it would be beneficial if Burp incorporated those features into the current version. 

The crawling techniques used in the current version are not as efficient as those used in earlier versions.

We have been using it for seven to eight years now. We have Burp Suite Professional and Burp Suite Enterprise Edition listed in our database.

We use the latest 2023 version. 

I would rate the stability an eight out of ten. If people know how to perfectly use it, it is a stable solution. For freshers, it is tough. 

I would rate the scalability a six out of ten. The primary reason is the high number of false positives compared to actual positives. 

Additionally, understanding the scan configuration can be challenging for newcomers. While experienced users can effectively scale their scanning techniques, those with limited experience may find it difficult to understand the process and identify the root causes of errors. 

Moreover, configuring proxy settings can be complex, leading to difficulties for some users. Overall, there are significant areas for improvement in terms of scalability, particularly in enhancing user understanding and reducing false positives. However, compared to other application security tools, Burp Suite still performs well.

There are around three end users using this solution in our company.

I haven't had the opportunity to interact with their technical team directly. However, the blogs are very informative and provide a wealth of solutions. In most cases, I've been able to resolve issues myself based on the information provided in their documentation. 

For the documentation or web security resources, I would rate it seven out of ten. Burp Suite effectively addresses user concerns and provides clear explanations. The technical blogs are also well-written and address concerns.

I have experience with Burp Suite Professional and Zap Framework. I've used them for a variety of application security testing tasks, including vulnerability scanning, penetration testing, and threat modeling.

I haven't had the need to explore other tools. I've been using Burp Suite since the beginning of my career, and it has consistently met my requirements. I've used other tools in lab settings, but Burp Suite remains my preference.

I would rate my experience with the initial setup of Burp Suite Professional an eight out of ten, with one being difficult and ten being easy.

The deployment was quite quick, only about ten minutes. It requires minimal staff. Anyone can install it on their own requiring administrator privileges. It can be installed on any system and with any version. 

However, the only caveat is that we need to obtain the license from the procurement team. So, it's easy to set up.

I would rate the pricing a one out of ten, with one being cheap and ten being expensive. The pricing is very reasonable and minimal.

First and foremost, I would suggest others thoroughly understand the fundamentals of Burp Suite and how to utilize its extensions effectively. 

Additionally, I would recommend learning about proxy settings and various authentication mechanisms. 

Lastly, I would emphasize the importance of carefully reviewing and configuring scan configurations to minimize false positives and ensure optimal scan performance.

Considering its capabilities and performance compared to other tools, I would give Burp Suite Professional an eight out of ten. 

I used this solution while working with a bank, and while it wasn't much of a DevSecOps tool, it was a good tool for penetration testing.

It is a good manual penetration tool. It was easy to learn.

If your application uses multi-factor authentication, registration management cannot be automated. There are also some session management issues we have found if we want to integrate it into the pipeline. There were also some authentication-related issues we found at the time. These issues were more specific to the enterprise edition. I have worked on a paid version of the standalone solution, which is best for manual penetration testing.

I rate Burp Suite's stability a ten out of ten.

I rate Burp Suite's scalability a seven out of ten. We wanted to have more scalability in my last company, where we wanted the enterprise edition, but there were some challenges we faced. We couldn't find a solution to the problem statements for most of our business use cases back then. We then dropped the idea of using Burp Suite Enterprise and opted for a standard one for manual penetration testing.

There were ten users in my unit working with Burp Suite.

Support-wise, the solution was also very good. Across the globe, all the manual penetration testers use Burp Suite. If we had any questions, we received good support from GitLab and other forums.

Whenever we raised any query, such as if we wanted to file an invoice for reimbursement at the organization level, the support was good at the nontechnical and technical levels.

Positive

The initial setup is easy, not only in the office, since I'm working on my laptop now with the community edition. The configuration is pretty straightforward.

Burp Suite is affordable. Admins can purchase the tool, which is affordable enough that college students can purchase it if they want to learn it.

The solution is not a good candidate for a DevSecOps tool.

I recommend this solution for manual penetration testers. It is the best tool with the best support. PortSwigger has added plugins to efficiently catch bugs, for example, HTTP request smuggling. There are a lot of plugins, such as how to hide the JWT token. These plugins minimize the effort required by manual penetration testers so they can find bugs quickly with the help of these plugins. They have good support if anybody wants to learn how to use and install plugins. There is a lot of documentation available online.

I rate PortSwigger Burp Suite Professional an eight out of ten.

We use it for application security testing purposes. We scan our solutions and then look for issues in them. Upon finding the issues, we send them to the development team who fixes them. However, we use Burp Suite only for a specific client, hence we only have one license and limited use.

The solution is quite helpful for session management and configuration. 

In the Professional version, we cannot link it with the CI/CD process. This feature is included in the enterprise version. Also, it doesn’t have a dashboard to preview the number of issues that were found. A dashboard showing previous issues and their status will be better. These all are enterprise features which are extremely expensive.

I have been using Burp Suite for two years.

It is a stable product. 

It is a scalable solution. We currently have only one to two people using Burp Suite for specific clients.

The customer support is good, however, I haven’t used other tools. It is difficult to compare it and other solutions might provide better support.

I personally don’t use a lot of tools except AWS for general clients.

Burp Suite is easy to set up and takes only five to ten minutes. The installation can be done by one person only. The maintenance isn’t very hard to do.

It is a cheap solution, but it may not be cheaper than other solutions.

I would advise others to also try other tools. As I have only used Burp Suite as an application security solution, I cannot comment on other tools. However, between JAP and Burp Suite, I would surely recommend Burp Suite. Overall, I would rate it an eight out of ten.