Web & API
Burp Suite
Intercepting proxy and scanner for authorized web and API testing, mapping, and manual review.
What it is
Burp is the working surface for web, API, and mobile-BFF engagements: intercept, repeater, logger, and (Pro) the crawler/scanner. Community edition covers manual work; scanner features need a licensed seat. Keep projects on the engagement volume, not a laptop that leaves the jump box.
Reach for it when
Any authenticated or unauthenticated web/API test where you need to inspect and replay HTTP with session handling.
Watch-outs
Disable out-of-scope hosts in the target filter. Do not enable active scanner against production without the RoE line that allows it. Strip real PHI/PAN from saved projects. Collaborator/OAST only against in-scope apps.
Typical invocation
Scope the portal host, map with the crawler (or manual), then replay access-control tests in Repeater.
Authorized assessments only. Stay inside the rules of engagement.
Pin to a kit
Open an engagement first.
Related
- OWASP ZAP
Open-source intercepting proxy and scanner for web and API assessments.
- Caido
Modern intercepting proxy for manual web and API testing with a workflow-oriented UI.
- ffuf
Fast web fuzzer for content discovery and parameter enumeration on in-scope applications.
- sqlmap
Automated SQL injection detection and confirmation against in-scope parameters.
- nuclei
Template-based vulnerability scanner for known issues on in-scope web, API, and network services.