Burp Proxy & Burp Suite – Attacking Web Applications

Find your website's Achilles' Heel

I love the Burp Suite, I really do. It’s pretty much my favourite local proxy program and my favourite suite of tools for security testing web applications (especially the session investigation and manipulation parts).

Another great thing is it’s cross platform, so you don’t have to learn different tools for Windows and Linux.

Burp Proxy

Basically Burp suite is an integrated platform for attacking web applications. It contains all of the burp tools (proxy, spider, intruder and repeater) with numerous interfaces between them designed to facilitate and speed up the process of attacking a web application. All plugins share the same robust framework for handling HTTP requests, authentication, downstream proxies, logging, alerting and extensibility.

Burp suite allows an attacker to combine manual and automated techniques to enumerate, analyse, attack and exploit web applications. The various burp tools work together effectively to share information and allow findings identified within one tool to form the basis of an attack using another.

Key features unique to burp suite include:

  • Ability to “passively” spider an application in a non-intrusive manner, with all requests originating from the user’s browser.
  • One-click transfer of interesting requests between plugins, e.g. from the proxy request history, or a web page form enumerated with burp spider.
  • Extensibility via the IBurpExtender interface, which allows third-party code to extend the functionality of burp suite. Data processed by one plugin can be used in arbitrary ways to affect the behaviour and results of other plugins.
  • Centrally configured settings for downstream proxies, web and proxy authentication, and logging.
  • Plugins can run in a single tabbed window, or be detached in individual windows.
  • All plugin and suite configuration is optionally persistent across program loads.
  • Runs in both Linux and Windows.

I’ll try and do some tutorials for Burp later on and perhaps I’ll focus a bit more on Burp Proxy alone, as it’s an extremely powerful tool.

Burp suite is a Java application, and runs on any platform for which a Java Runtime Environment is available. It requires version 1.4 or later. The JRE can be obtained for free from Sun.

You can download Burp Suite below, both archives contain the same files, which will run under both Windows and Linux.


Posted in: Hacking Tools, Security Software, Web Hacking

Recent in Hacking Tools:
- DyMerge – Bruteforce Dictionary Merging Tool
- mitmproxy – Intercepting HTTP Proxy Tool aka MITM
- mimikittenz – Extract Plain-Text Passwords From Memory

Related Posts:

Most Read in Hacking Tools:
- Top 15 Security/Hacking Tools & Utilities - 1,995,040 views
- Brutus Password Cracker – Download brutus-aet2.zip AET2 - 1,488,855 views
- wwwhack 1.9 – Download wwwhack19.zip Web Hacking Tool - 688,682 views


  1. SPIKE Proxy - Application Level Security Assessment » - January 30, 2007

    […] SPIKE is a fairly mature tool having been around since about 2003, we at Darknet use Spike Proxy along with the Burp Suite for web application security analysis. […]

  2. Echo Mirage - A Generic Network Proxy » - January 30, 2007

    […] Think of it as Odysseus (or Burp, if you prefer) that will proxy (almost) anything… […]

  3. Oedipus - Open Source Web Application Security Analysis » - January 30, 2007

    […] Capable of parsing several different types of log files, such as Burp, Paros, etc, identifying potential security vulnerabilities using pattern matching – An Oedipus input file is also produced. […]

  4. Paros Proxy 3.2.11 Released - MITM HTTP and HTTPS Proxy » - January 30, 2007

    […] One of my favourite proxy options, along side the Burp Proxy (evolved into Burp Suite). […]

  5. Paros Proxy 3.2.10 Released - MITM HTTP and HTTPS Proxy » - January 30, 2007

    […] One of my favourite proxy options, along side the Burp Proxy (evolved into Burp Suite). […]