Burp Suite
Security Testing
Freemium
<What you get/>
Authorisation testing that a UI-driven suite structurally cannot perform
Systematic OWASP Top 10 coverage rather than ad-hoc probing
Findings delivered with the exact request that produced them, ready to reproduce
A clear statement of where this stops and a formal penetration test begins
What it is
Burp Suite is the standard toolkit for web application security testing: an intercepting proxy for inspecting and manipulating traffic, a scanner for known vulnerability classes, and manual tooling for the findings that automation cannot reach. It is what a security-focused tester reaches for when assessing an application against the OWASP Top 10.
How PerfectQA uses Burp Suite
We use Burp Suite for the security testing that belongs inside functional QA rather than in a separate annual engagement — checking that the authorisation model actually holds, that inputs are handled safely, and that session behaviour is sound. The most valuable work is usually the least glamorous: intercepting requests and altering identifiers to confirm a user cannot read another user’s data, because broken object-level authorisation is both extremely common and invisible to a UI-driven test suite that only ever clicks what the interface offers. We work against the OWASP Top 10 as a checklist so coverage is systematic rather than driven by whatever we happen to think of, and findings come with the request that produced them so a developer can reproduce it in seconds. This is not a penetration test and we do not present it as one — it is security-aware QA, and we are clear about the boundary.
Category
Security Testing
In our stack
5 years
Projects
13 delivered
Where we’ve put it to work
Frequent questions
Is this a penetration test?
What do you find most often?
Do you need production access?
Can this run in CI?
Every stack is different
Tell us yours, and we’ll show you where this fits
