Burp Suite.

Burp Suite is the industry-standard web application security testing platform, created by Dafydd Stuttard beginning around 2003–2006 and developed by his company PortSwigger. It works as a man-in-the-middle proxy: the tester routes a browser through Burp, which installs its own CA certificate so it can decrypt TLS, then pauses each request for inspection and tampering. Around this core sit Repeater (hand-craft and replay single requests), Intruder (automated payload fuzzing for injection and brute-force), Decoder, Comparer, Sequencer (token entropy analysis), and the BApp extender API for community extensions.

The Professional and Enterprise editions add an active DAST scanner that crawls and audits for the OWASP Top 10 — SQL injection, XSS, SSRF, and more. A pivotal 2015 addition, Burp Collaborator, provides an attacker-controlled external service that detects blind and out-of-band vulnerabilities (blind XSS, SSRF, asynchronous injection) by observing DNS/HTTP callbacks the target makes back to it — issues invisible to in-band testing. Burp underpins much of PortSwigger's free Web Security Academy and is a staple in bug-bounty and pentest workflows.

Crucially, Burp is a dual-use offensive tool: intercepting or fuzzing an application without authorization is illegal in most jurisdictions. Legitimate use requires explicit written permission — a signed pentest scope or a bug-bounty program's rules of engagement — before any traffic is sent.

flowchart LR
  A[Browser] -->|HTTP/S| B[Burp Proxy - MITM w/ own CA]
  B --> C{Inspect / modify}
  C --> D[Repeater: replay]
  C --> E[Intruder: fuzz payloads]
  C --> F[Scanner: DAST audit]
  F --> G[Target web app]
  D --> G
  E --> G
  G -.->|blind/out-of-band callback| H[Burp Collaborator]