Burp Suite: Overview History and Usage

Burp Suite is a very popular java-based Application Security Testing Software from a company known as PortSwigger. It is aimed at testing web apps and dynamic websites. It allows penetration testers to check for vulnerabilities in web applications. Burp is basically a proxy server where web app requests and responses are intercepted, allowing for analysis of data content and data flow, resulting in the detection of vulnerabilities.

Think of BURP as a more advanced, real-time version of the debugger or script inspector tools of browsers like Chrome or Firefox, with a lot more bells and whistles included. It can basically also act as a debugger for web apps or even a quality inspection tool for developers who take security seriously. And as a penetration testing tool, Burp suite also allows for attack testing and offers various avenues for attacks against vulnerable websites.

History

Burp v1.0 was first released last June 2003 by its creator Daffyd Stuttard and current CEO of the company PortSwigger. At this point, it is mainly the Intruder Tool. Complete with unstoppable burp sounds from the young mischievous developer. The Proxy Tool and Repeater Tool were released shortly in August 2003. A more improved version with more tools is released in January 2004 on version 1.1. The Spider tool makes its debut in August the same year.

The actual Burp suite version 1.0 is released the following year, August 2005 which includes the extensibility feature, making the suite much more flexible. More improvements released in the following years. Version 1.3 is released January 2010 with the improved rendering of HTTP messages and the addition of the manual testing simulator. By 2011, Burp jumps in popularity and is downloaded up to 10,000 times a month.

Version 2 came out by January 2018 but by the year 2020, they changed versioning numbers to include the year. Burp Suite is currently on version 2021.9.1 for the Professional and Community Editions with hundreds of updates since 2010. Burp Suite is now considered an industry standard hacking tool.

Usage

Burp Suite is used by over 50,000 cybersecurity professionals, and by possibly countless hackers to check for flaws in many corporate web applications. It’s popularity stems from its ease of usage thanks to an intuitive IDE and powerful features such as:

Allowing users to look at web Requests and Responses using Proxy. Burp suite intercepts the web traffic to and from one or several websites, so testers can check web app activity behind the scenes. Proxy also displays plenty of information such as browser type, web platform, host, and encoding. Information that can be of use to hackers and should not be made visible in secure web apps.

And Burp suite can uncover much more with its powerful web crawling algorithm, enabling testers to map much of a web app’s components and process flow through the professional version’s Site map.

Testing web apps by manipulating values using Repeater. Burp gives users the ability to interact and change values. It acts much like a macro creator and player which saves users plenty of time repeating key strokes and mouse clicks.

Encode/Decode URL encoded values with Decoder. During testing, websites make use of encoded values, long unintelligible strings in requests and responses. Decoder lets testers know what those values could be.

And with all the knowledge gained from the aforementioned tools, anomalies and security flaws can be easily detected. Testers can then try attack methods such as SQL Injection using Intruder or use it to deploy other types of payloads. Burp’s usability can be further expanded by adding more functionality via free or paid extensions using Extender.

Burp Suite is accessible to all prospective hackers or pen testers through the free community version available for Windows, Linux and MacOS. The community edition is also one of the many tools built into Kali Linux and Parrot OS. There are plenty of things that can be done in the Community Edition, but serious professional pen-testers can do a lot more using the Professional and Enterprise editions.