There is a tree view showing a hierarchical representation of application content where issues have been found, with URLs broken down into domains, directories, and files. If you select one or more parts of the tree, all of the scan issues for the selected items are listed, with issues of the same type grouped together. You can expand these aggregated issues to view all of the individual issues of each type.
If you select an issue, the relevant details are displayed, including:
Often, the fastest way to reproduce and verify an issue is to use the context menu on the message editor to send the request to Burp Repeater. Alternatively, for GET requests, you can copy the URL and paste it into your browser. Then you can reissue the request, and if necessary fine tune the proof-of-concept attack that was generated by Burp.
Every issue that Burp Scanner reports is given a rating both for severity (high, medium, low, informational) and for confidence (certain, firm, tentative). When an issue has been identified using a technique that is inherently less reliable (such as for blind SQL injection), Burp makes you aware of this, by dropping the confidence level to less than certain. These ratings should always be interpreted as indicative, and you should review them based on your knowledge of the application's functionality and business context.
The issue listing has a context menu that you can use to perform the following actions:
Get help from other users, at the Burp Suite User Forum:
Burp Suite Free Edition v1.6 contains significant new features added since v1.5, including support for WebSockets messages, PKCS#11 client SSL certificates contained in smart cards and physical tokens, a new Extender tool, allowing dynamic loading and unloading of multiple extensions, and the BApp Store, allowing quick and easy installation of extensions written by other Burp users.
Burp Suite Professional contains a number of bugfixes and tweaks, added since the last beta version.