Burp Suite Professional is a toolkit for people whose job is to assess the security of websites and web applications. It comes from PortSwigger Ltd, a British company, and traces back to Dafydd Stuttard, who wrote the very first version of Burp between 2003 and 2006 according to the timeline on the publisher’s site. The software is proprietary and sold on subscription, while a free Community Edition offers the manual tools on their own.
PortSwigger says it has more than 70,000 customers, 16,000 of them enterprises. The range also includes Burp Suite DAST, an automated scanner aimed at large organisations.
What Burp Suite Professional is for
Everything revolves around an intercepting proxy. The tester’s browser, or the preconfigured Chromium browser bundled with Burp, sends its traffic through the tool, so every HTTP or HTTPS request and every WebSocket message exchanged with the target lands in a history where it can be studied closely. Sitting in the middle like this exposes what the user interface hides, such as hidden parameters, headers, session tokens and the API calls that JavaScript code fires in the background.
A set of specialised modules surrounds the proxy. Repeater resends a request by hand, Decoder translates data between encodings, Comparer lines up two responses, and Sequencer measures how random an application’s tokens really are. The Professional edition adds the pieces that save hours on a real engagement: Burp Scanner, which crawls the site on its own and reports web vulnerabilities, the unrestricted version of Intruder for sending many variations of a request, Burp Collaborator for flaws that only show up outside the visible response, saved project files, search, and an AI assistant called Burp AI.
Customisation is part of the design. The built-in BApp Store lists more than 300 extensions from over 250 authors, PortSwigger says, and the Bambdas and BChecks features let testers write small filters and checks of their own. Burp Suite DAST relies on the same engine for scheduled scans or scans inside a CI/CD pipeline, hosted by PortSwigger or on your own servers.
Compared with other tools in our software library, Burp has a clearly defined territory, namely HTTP traffic. MobSF inspects the code of mobile apps and Frida instruments a program while it runs, whereas Burp watches the conversation between an app and its server. The open source ZAP project remains the best-known free alternative.
Who is it for?
The Professional edition targets penetration testers working under contract, application security teams checking their own services before release, and researchers taking part in bug bounty programmes. Community Edition suits learners and developers who simply want to see what their application actually sends over the wire.
There are clear boundaries. Burp deals with the web and APIs only, so it does not replace a port scanner such as Masscan or a password auditing tool such as Hashcat. Getting value from it requires a solid grasp of HTTP and of the main vulnerability classes, otherwise scanner findings are hard to interpret. On the hardware side, the documentation sets 4 GB of memory as the minimum and recommends 16 GB, and a single project file can grow to tens of gigabytes.
Download Burp Suite Professional safely
Installers are listed on the PortSwigger release page, which separates stable builds from newer Early Adopter builds. It offers installers for Windows, macOS and Linux on both x64 and ARM, plus a cross-platform JAR file, all with MD5 and SHA-256 checksums. Community Edition is a free download. Professional needs a licence, which PortSwigger lists at 499 dollars per user for one year, with commitments of up to ten years. A full trial with no credit card is available on request from a work email address.
A Professional edition handed out for free on a forum or a download portal can only be a pirated copy. Because the tool sits in the path of all the traffic of an engagement, including credentials, session cookies and client data, it is the last place where a binary tampered with by a stranger belongs.
Frequently asked questions
Is Burp Suite free?
Community Edition is, with the manual tools and a demo version of Intruder. Professional costs 499 dollars per user per year according to PortSwigger’s website, and a free trial lets you evaluate it before buying.
What does Professional add over Community?
It brings the vulnerability scanner, automatic crawling, the full Intruder, Burp Collaborator, saved projects and history search. Subscribers also get the extensions reserved for Professional users and the Burp AI assistant.
Can Burp be used against any website?
No. PortSwigger’s licence agreement forbids scanning sites or systems without permission from their owner. A penetration test is carried out under a written agreement that defines the scope and the testing window.
