Burp Suite, the leading toolkit for web application security testing


This tab is used to configure one or more payload sets. The number of payload sets depends on the attack type defined in the Positions tab. For many common tasks, such as fuzzing parameters, brute force guessing a user's password, or cycling through page identifiers, only a single payload set is needed.

The configuration steps needed to configure a payload set are as follows:

Support Center

Get help and join the community discussions at the Burp Suite Support Center.

Visit the Support Center ›

Tuesday, October 6, 2015


This release adds the ability to annotate the active scan queue with comments and highlights, as is already possible in the Proxy history and Target site map

A number of other fixes and enhancements have also been applied.

See all release notes ›

Copyright © 2015 PortSwigger Ltd. All rights reserved.