Burp Suite Professional Review as an Ex NCC Group Consultant

02 Jun 2024

I used Burp Suite Professional during web application pen tests for Fortnue 500 companies and I have access as a independent security person. To be candid, it’s a rip off to buy a license for $400 and there’s many cracked versions of the professional edition on the interwebz.

While yes, I do and used to use it professionally as well as now. It’s scan feature SHOULD NOT be depended on to do a proper job and 90% of it’s finding are noise as well as just plain false positives. The tools are very useful while following OWASP’s testing methodology, but again you shouldn’t use Burp or any other automated vulnerability scanner for your assessment. If you do, then you’re probably a skid honestly.