Our verdict: Burp Suite Community Edition is the free entry point to the toolkit most web penetration testers use. The intercepting proxy, Repeater and Decoder are enough to learn web security and test by hand. The vulnerability scanner, full-speed Intruder and saved project files are reserved for the paid Professional edition.
About Burp Suite Community Edition
Burp Suite is made by PortSwigger. The Community Edition is a manual testing toolkit: an HTTP(S) and WebSocket proxy with history, plus Repeater for resending modified requests, Decoder for encoding and decoding data, Sequencer for analyzing token randomness and Comparer for diffing requests or responses. Burp Intruder is included only as a demo version.
Community Edition is free and installs from the same installer as Professional; you choose the edition during setup. Professional adds project files to save your work, the full Burp Intruder, the web vulnerability scanner, automated crawling, Burp Collaborator for out-of-band testing, a search function and Pro-only BApp extensions. Only test applications you own or have permission to test.
What it does well
- Intercepting proxy. Captures HTTP, HTTPS and WebSocket traffic and lets you edit it in flight.
- Repeater. Resends a captured request with your changes and shows the response.
- Decoder and Comparer. Encodes or decodes data and highlights differences between two messages.
- Sequencer. Tests how random session tokens and other values really are.
- BApp extensions. Adds community extensions from the BApp Store inside Burp.
Who it is for
Good fit
Students, bug bounty beginners and developers who want to learn web security and test their own apps by hand.
Look elsewhere
Professional testers who need automated scanning, saved projects or fast Intruder attacks.
Pros and cons
Pros
- Free toolkit from the industry-standard web testing suite
- Intercepting proxy with HTTP and WebSocket history
- Repeater, Decoder, Sequencer and Comparer included
- Extensions from the BApp Store
Cons
- No vulnerability scanner or automated crawling
- Projects cannot be saved; only temporary projects
- Burp Intruder is only a demo version
How to install Burp Suite Community Edition
The button downloads the latest Windows x64 installer from portswigger.net. The installer is shared with Professional, so choose Community Edition when asked. Community Edition works only with temporary projects, so export anything you want to keep before closing. To see HTTPS in other browsers, install the Burp CA certificate.
Questions about Burp Suite Community Edition
Is Burp Suite Community Edition free?
Yes. Community Edition is free to download and use. The scanner, saved projects, full Intruder and Burp Collaborator are part of the paid Professional edition.
What is the difference between Burp Suite Community and Professional?
Community is a manual toolkit with the proxy, Repeater, Decoder, Sequencer, Comparer and a demo of Intruder. Professional adds project files, automated scanning and crawling, the full Intruder, Burp Collaborator, search and Pro-only extensions.
Is it legal to use Burp Suite?
Yes, as a tool. Only test websites and apps that you own or have written permission to test.
