A Quick Guide to the Tools Offered in Burp Suite

Burp Suite prides itself as “the choice of security professionals around the globe”. Many individuals and organizations use Burp Suite to secure their site and the web, and to speed up software delivery. In this quick guide, we will talk about what Burp Suite is, what it offers, who can use it, and the tools in the Burp Suite application.

What Is Burp Suite?

Burp Suite, commonly called Burp, is a set of Java-based tools used for web applications’ penetration testing developed by the Portswigger company. It helps web security professionals identify website or application vulnerabilities and verify attack vectors. Burp has become the industry standard suite for tools that information security professionals use in web penetration testing and malware/bug bounty hunting because of its depth of features. For example, android developers often use Burp Suite for Android in testing android applications and vulnerabilities.

What Are the Burp Suite Plans?

Burp Suite is available in three plans or editions for web, app, and feature testing:

• Burp Suite Community Edition — Free: The most basic Burp Suite tool available to everyone and contains Burp Intruder (demo), HTTP(s)/WebSockets proxy and history, and Essential tools like Sequencer, Repeater, Decoder, and Comparer.
• Burp Suite Professional Edition — $399/year: This is a professional-level tool that includes everything in the community edition plus Project files (for saved work), Web vulnerability scanner, search function, Burp Intruder full version, BApp extensions, and more.
• Burp Suite Enterprise Edition—  $3999/Year:  This is the most sophisticated tool that enables automated web vulnerability scanning with scheduled scans, intuitive remediation advice, CI/CD integrations, and reporting.

**Pricing of Burp Suite at the writing of this article

The Tools Offered in Burp Suite

The tools or features offered in Burp Suite depend on the edition you buy. The following are the tools you will find in Burp Suite:

• Sequencer: This helps check for the randomness of the webserver’s generated tokens, such as cookies and anti-CSRF tokens, allowing it to authenticate sensitive operations. You can read more about Sequencer and other Burp Suite tools here.
• Spider: Web crawlers are used to map a target web application to get a list of endpoints that enables the observation of their functionalities and potential vulnerabilities.
• Proxy: An intercepting proxy in Burp Suite lets analysts see and modify the contents of web requests and responses on transit — to or from. This allows application behavior watch and interception of bugs.
• Intruder: A fuzzer that runs a set of web values via an input point while allowing observation of the output for content length or success/failure. Any anomaly will result in a change in the response’s content length or response code. 
• Repeater: This feature lets a user send requests repeatedly using manual modifications. It helps verify user-supplied values, the success of verification, how the server handles unexpected values, and more.
• Extender: Supports the inclusion and integration of external tools (BApps) into BurpSuite to enhance its capabilities. BApps work like browser extensions and can be modified, installed, viewed, and uninstalled in the Extender window.
• Decoder: This tool lists the common encoding methods such as URL, HTML, Hex, and Base64, and is useful when searching for data in values of headers and parameters. It helps uncover session hijacking and cases of IDOR.
• Scanner: Not available in the Burp Suite community edition. It is an automated web scanner that identifies many common vulnerabilities and lists them in their order of complexity of exploitation. 

Endnote 

Burp Suite is an industry-leading web security analysis tool. It helps discover vulnerabilities before bad actors and cybercriminals can exploit them. It also helps users catch zero-day threats before they can be actioned on, hence a great tool for protecting web health.