Burp Suite Professional

Product roadmap

We've got big plans for the road ahead - and we're sure you do too.

Roadmap for Burp Suite Professional

Integrated SCA capabilities

New feature

Perform software composition analysis (SCA) of client-visible code. Report JavaScript libraries in use that contain known vulnerabilities.

Improved workflows

Feature enhancement

Faster analysis and decoding. An evolved user interface will make manual testing with Burp Suite more convenient than ever.

Enhanced Burp Intruder

Feature enhancement

More options for brute forcing and fuzzing. New payload types and placement options, richer results analysis, and incremental saving.

We're currently scoping exciting new features for Burp Suite Professional - check back soon.


API scanning

Done

Enumerate API endpoints to scan APIs in target applications. API scanning utilizes OpenAPI (Swagger) definitions.

Automatic updates

Done

Update without lifting a finger. Includes an optional early adopters' track - giving early access to new and experimental features.

Browser-powered scanning by default

Done

Best-in-class coverage and scanning performance for challenging targets like AJAX-heavy single page app, with browser-driven (Chromium) scanning. Enabled by default.

New web cache poisoning scan checks

Done

Find cutting-edge vulnerabilities with Burp Scanner. Scan checks based on James Kettle's latest web cache poisoning research.

HTTP/2 support

Done

Use HTTP/2 for both inbound and outbound communication over TLS (beta feature). Also gives control of TLS protocols within Burp Proxy.

Render pages within Burp tools

Done

See exactly what you're looking at - without changing tab. Tools like Burp Repeater and Burp Intruder now allow you to render responses.

Read all release notes

Inspector view

Done

Manipulate browser traffic more easily. Improved access to headers, parameters, and more - plus automatic encoding and decoding.

Recorded login sequences

Done

Better scrutinize login-related functionality by recording complex login sequences in a browser. Ideal for JavaScript-heavy logins, or single sign-on.

Embedded browser for manual testing

Done

Proxy HTTPS traffic with no configuration necessary. Burp Suite's embedded Chromium browser can now take care of everything.

Pretty printing in the HTTP message editor

Done

Make code easier to work with. Burp Suite will prettify JSON, XML, HTML, CSS, and JavaScript within the HTTP message editor.

Browser-powered scanning enhancements

Done

Significant improvements to Burp Scanner - enabling enhanced performance and coverage of modern navigational patterns.

Customer quote

The tool is self sufficient, with many features out of the box and allows for extensibility. No need for servers or databases. It's a well calibrated "gun". It lets us either validate findings from external security reports or penetration test our software while in development. Source: TechValidate survey of PortSwigger customers

See more customer stories

Software Engineer

Large Enterprise Financial Services Company