Burp in the Community.
Twenty years of pentesters opening Burp. Twenty years of meeting at Black Hat, arguing on Discord, writing BApps, dropping research. The tool is ours. The community is yours.
Where the community gathers.
Black Hat. DEF CON. OWASP AppSec. RomHack. EkoParty. The big stages where the research lands. BSides Leeds, BSides Exeter, SteelCon, HackGlasgow, StudentHack: the grassroots where the next generation of bug hunters meet Burp for the first time. HAC NYC, HAC LDN, FOST Paris: the API and AI conversations.
Wherever the AppSec community gathers, Burp is in the room. Sometimes with us on a booth, sometimes on a laptop someone else brought.
HTTP/1.1 Must Die.
Backing James Kettle's eleventh Black Hat paper with a community call-to-arms. The campaign, the shirts, the room.
2025 in review · 2026 ahead
The way that Burp has developed, how you listen to the community, and create free learning material, it's absolutely amazing.
— Andres Rauschecker
Where the conversation lives.
Discord is where the day-to-day happens. BApp swaps, webinars, the trick that worked last night, the question you didn't want to put on a forum. The BApp Store is where it ends up codified: hundreds of extensions the community built on top of Burp.
Share BApps. Trade techniques. Help the next pentester unblock the bug. Where most of the day-to-day conversation lives.
Open Discord →Hundreds of extensions. Written by the community.
JWT Editor. Logger++. Param Miner. Autorize. Hackvertor. Active Scan++. Authentication Token Obtain and Replace. Collaborator Everywhere. Most of what makes Burp yours was built by somebody else first.
Introducing our Burp Ambassadors.
Five people from five countries who teach Burp, speak about Burp, build BApps, run training, run podcasts and run live-hacking events. None of them work for PortSwigger. All of them are trusted by the community already. That's why they're here.
Five Ambassadors. Five countries. One Burp.
Alan Levy · Corey Ball · Federico Dotta · Rana Khalil · Tib3rius.
Pentester and bug hunter, on Burp since 2011. Speaks at conferences and brings the Argentine AppSec scene with him.
Author of Hacking APIs and writer of the hAPI Blog. If you've learned API security in the last five years, chances are some of it came from him.
Pentester on Burp since 2010. Built Brida and the tools the rest of the extender community quietly depends on.
One of the most-watched AppSec teachers on YouTube. Her Burp Suite walkthroughs are the on-ramp for thousands of new pentesters every year.
Pentester and content creator, on Burp since 2011. Brings advanced web-application testing to wide audiences through livestreams and Twitch sessions.
Champions doing the work, in public.
A growing global network of Champions: ethical hackers, CISOs, researchers, educators. They teach Burp, run workshops, host CTFs, write the labs people learn from. Selected by application, supported by us. Here's a few of them, in their own words.
"I won't hide it — Burp Suite has been my daily companion during penetration tests and CTFs, and now I can officially represent this community in Poland and beyond."
Michał Błaszczak · CISO, Vercom S.A. · Poland
"Burp Suite has genuinely been one of the most constant tools in my workflow… It's hard to think of a point in my security journey where it wasn't open on my screen."
Otsmane Ahmed · Cybersecurity Researcher
"Being part of this program is a fantastic opportunity to give back to the community, provide direct feedback to the PortSwigger team, and help others sharpen their pentesting skills."
John P. · Penetration Tester · Truist / Synack
Become a Burp Champion.
30-second application. Contribute in your own way, when it works for you.
The research everyone reads.
PortSwigger Research has published eleven Black Hat papers in a row. The Top 10 Web Hacking Techniques, started by Jeremiah Grossman back in 2006 and picked up by us in 2017, sets the tempo for everyone else's research year. Open nominations, community vote, awarded on stage.
Eleven consecutive Black Hat papers. And counting.
// DEF CON main stage · 2025 Cutting-edge research is what keeps Burp ahead. Every disclosure becomes a technique you can run today, on a tool your peers have been auditing in public for two decades.
The community-voted annual.
Nineteen editions in. Every January, the security community nominates the year's best web hacking research; a community vote shortlists fifteen. This year's panel was Soroush Dalili, STÖK, LiveOverflow, Nicolas Grégoire and James Kettle. They picked and ordered the final ten. Award ceremony at DEF CON.
Learn here. Be recognised here.
The Web Security Academy has been free since 2019, and it's where most people learn web security for the first time. Hundreds of thousands of them, every year. The Burp Suite Certified Practitioner credential turns up on AppSec resumes from Bishop Fox to Microsoft to the engineer three desks down.
The free training the AppSec world trains on.
Over 250 labs across XSS, SQLi, SSRF, authentication, access control, request smuggling, prototype pollution, race conditions, GraphQL and JWT. All built by the same Research team that publishes the Black Hat papers. Free. No login required to read. The lab platform is the only thing behind sign-in, because the labs are interactive.
Earn the badge. Carry it on LinkedIn.
The Burp Suite Certified Practitioner exam tests real Burp workflow under a clock. Hands-on labs, not multiple choice. People fail it. Then come back. That's the point. The exam doesn't let through people who can't actually use the tool.
- Hands-on · lab-based, not multiple choice
- On the clock · workflow under time pressure
- Re-takeable · fail-then-return culture
Who else we're building this with.
Bug-bounty platforms. Social-media giants who run programmes at scale. The firms whose researchers we already know by name. Where their work and ours overlap, we co-invest. Training, licences, conferences, joint research.
Find your people.
Whether that's the Discord on a Tuesday night, the Black Hat floor in August, the lab you finish at 2am, or the BApp you publish next year. Burp is the tool. The community is the room. Pick a door.
Follow us
// where Burp shows up in your feed