You can set the type of payload that you want to inject into the base request. Burp Intruder provides a range of options for auto-generating different types of ...

Burp Suite brings AI to your security testing in two complementary ways: Burp AT, which brings agentic AI to human-led pentesting, and Burp AI, which assists you within the Burp tools you already use.

Recorded login sequences enable Burp Scanner to audit content that only authenticated users can usually see, even on sites that use complex login mechanisms such as Single Sign-On. This section ...

If you need to use an external browser with Burp instead of Burp's preconfigured Chromium browser, perform the following configuration steps. For the vast majority of users, this process is not ...

You need to configure Firefox so that you can use it for testing with Burp Suite.

This documentation describes the functionality of all editions of Burp Suite and related components. Use the links below to get started: ...

When testing web applications, you may encounter challenges relating to session handling and application state. For example: The application may terminate the testing session, either defensively or ...

Many servers now support HTTP/2. This exposes them to potential vulnerabilities that are impossible to test for using tools that only speak HTTP/1. Burp Suite provides unrivaled support for ...

Burp Suite is a comprehensive suite of tools for web application security testing. This interactive tutorial is designed to get you started with the core features of Burp Suite as quickly as possible.

Burp Collaborator is a network service that enables you to detect invisible vulnerabilities. These are vulnerabilities that don't: Trigger error messages. Cause ...

This page answers common questions about how Burp AT and Burp AI keep your testing safe, how you stay in control when using AI features, and how PortSwigger handles the data you send. Both Burp AT and ...

Burp's support for invisible proxying allows non-proxy-aware clients to connect directly to a Proxy listener. This is useful if the target application uses a thick client component that runs outside ...