The Burp Suite family

Essential manual toolsProfessionalCommunity

• Burp Proxy allows manual testers to intercept all requests and responses between the browser and the target application, even when HTTPS is being used.
• You can view, edit or drop individual messages to manipulate the server-side or client-side components of the application.
• The Proxy history records full details of all requests and responses passing through the Proxy.
• You can annotate individual items with comments and colored highlights, letting you mark interesting items for manual follow-up later.
• Burp Proxy can perform various automatic modification of responses to facilitate testing. For example, you can unhide hidden form fields, enable disabled form fields, and remove JavaScript form validation.
• You can use match and replace rules to automatically apply custom modifications to requests and responses passing through the Proxy. You can create rules that operate on message headers and body, request parameters, or the URL file path.
• Burp helps eliminate browser security warnings that can occur when intercepting HTTPS connections. On installation, Burp generates a unique CA certificate that you can install in your browser. Host certificates are then generated for each domain that you visit, signed by the trusted CA certificate.
• Burp supports invisible proxying for non-proxy-aware clients, enabling the testing of non-standard user agents such as thick client applications and some mobile applications.
  Read More
• HTML5 WebSockets messages are intercepted and logged to a separate history, in the same way as regular HTTP messages.
• You can configure fine-grained interception rules that control precisely which messages are intercepted, letting you focus on the most interesting interactions.
• The target site map shows all of the content that has been discovered in sites being tested. Content is presented in a tree view that corresponds to the sites’ URL structure. Selecting branches or nodes within the tree shows a listing of individual items, with full details including requests and responses where available.
• All requests and responses are displayed in a feature-rich HTTP message editor. This provides numerous views into the underlying message to assist in analyzing and modifying its contents.
• Individual requests and responses can be easily sent between Burp tools to support all kinds of manual testing workflows.
• The Repeater tool lets you manually edit and reissue individual requests, with a full history of requests and responses.
• The Sequencer tool is used for statistical analysis of session tokens using standard cryptographic tests for randomness.
  Read More
  
• The Decoder tool lets you convert data between common encoding schemes and formats used on the modern web.
• The Clickbandit tool generates working clickjacking attacks against vulnerable application functions.
  Read More
• The Comparer tool performs a visual diff between pairs of requests and responses or other interesting data.
• You can create custom session handling rules to deal with particular situations. Session handling rules can automatically log in, detect and recover invalid sessions, and fetch valid CSRF tokens.
• The powerful Burp Extender API allows extensions to customize Burp’s behavior and integrate with other tools. Common use cases for Burp extensions include modifying HTTP requests and responses on the fly, customizing the Burp UI, adding custom Scanner checks, and accessing key runtime information including crawl and scan results.
  Read More
• The BApp Store is a repository of ready-to-use extensions contributed by the Burp user community. These can be installed with a single click from within the Burp UI.