Burp Suite

Burp Suite is a web application security testing platform originally developed between 2003 and 2006 by British security researcher Dafydd Stuttard, who used the handle "PortSwigger" on hacker forums and later adopted it as the name of his company. Stuttard built the tool to automate his own manual security testing work, releasing the first standalone component — an early version of Burp Intruder — in June 2003, followed by Burp Proxy the same year and Burp Spider in 2004. These separate utilities were unified into a single interface as Burp Suite v1.0 in August 2005, allowing the tools to share traffic and state for the first time. Stuttard went on to co-author The Web Application Hacker's Handbook (2007), which cemented Burp Suite's association with formal web pentesting methodology.

The Intercepting Proxy Architecture

Burp's core design places an intercepting HTTP(S) proxy between the tester's browser and the target application, letting every request and response be captured, inspected, and modified before it reaches its destination. Around this proxy, PortSwigger built a suite of interoperating tools — Repeater for resending and tweaking individual requests, Intruder for automated fuzzing and brute-forcing, Sequencer for analyzing token randomness, Decoder, and Comparer — joined later by an automated vulnerability scanner (added with Burp Suite v1.2 in December 2008). This proxy-centric workflow became the template that most subsequent web application testing tools would follow.

Editions and Extensibility

Burp Suite is distributed in tiers: a free Community Edition offering the core proxy and manual tools; a paid Professional Edition aimed at individual testers, adding the full scanner; and an Enterprise Edition, first released in 2018, aimed at continuous DAST scanning inside CI/CD pipelines. Burp Suite exposes an extension API that lets third parties add functionality; the BApp Store, PortSwigger's marketplace for these extensions, has hosted well over 200 community and in-house plugins, including tools written by PortSwigger's Director of Research, James Kettle.

Role in Web Security Research

Burp Suite has served as the practical foundation for major published web security research, most notably James Kettle's work on HTTP request smuggling / HTTP desync attacks. By the 2010s, Burp Suite had become the standard toolkit referenced in bug bounty programs and penetration testing certifications, and PortSwigger's free Web Security Academy training platform surpassed one million users. In 2024, PortSwigger raised $112 million in its first outside funding round after 17 years of bootstrapped, profitable growth.

Timeline

• 2003PortSwigger founded by Dafydd Stuttard, who begins developing Burp.
• 2003-06First version of Burp (an early Intruder tool) released.
• 2004-03Burp Spider v1.0 released, an application-aware crawler.
• 2005-08Burp Suite v1.0 unifies Proxy, Repeater, Spider, and Intruder into a single interface.
• 2007Dafydd Stuttard co-authors The Web Application Hacker's Handbook.
• 2008-12Burp Suite v1.2 introduces the automated Burp Scanner.
• 2018-08Burp Suite Enterprise Edition released for continuous, pipeline-integrated DAST scanning.
• 2024-06PortSwigger raises $112 million in its first external funding round.