Viewing requests sent by Burp extensions.Testing for SQL injection vulnerabilities.Testing for parameter-based access control.Identifying which parts of a token impact the response.The following article Functionalities and extensions will specify some extensions that simplify some time-consuming tasks.ĭetail the principles of four essential modules of this software.Search Professional and Community Edition Other complementary modules, called extensions, are available to download via the extender (the “catalog” of Burp). Some of the modules are installed by default in the software, which are the essentials modules to run an audit. However, by its modularity with its extensions, its ergonomics and its active community (who develops new extensions and creates detailed documentation about the modules), Burp has become a reference tool in its category.īurp’s global functioning is designed in a modular way. The tool ZAP developed by the OWASP or VEGA indeed offer the same functionalities. Thanks to its different functionalities easily configured, it is the Swiss Army knife of a pentester.īurp Suit is not the only software to offer functionalities like vulnerability scanner and web proxy. This tool is the indispensable software to audit a web application, as it meets the first need of an audit professional: to access the exchanges between the browser and the web server, in order to understand the architecture and how the solution to be audited works.

We are talking here below of these three modules and the scanner, which is included in the paid version. Burp Suite has a free version, which includes the proxy, the repeater and the intruder (in a limited way). This software is developed by PortSwigger. Its main functionalities are a web proxy and a web vulnerability scanner. Burp Suite, most often only called Burp, is a tool dedicated to auditing web platforms.

Burp pro