In this section, the necessary installation instructions for the Burp Suite software are provided. The details, starting with the download of Burp Suite, include information about the two main existing versions of Burp Suite and the differences between them.
To use Burp Suite, a hacker or penetration testing device needs a target application. In the upcoming sections, steps for downloading and installing OWASP applications on a Virtual Machine (VM) will be explained. These applications will serve as the targeted vulnerable web applications throughout the Burp Suite article series.
The first step in learning the techniques I will discuss throughout the Burp Suite article series is to download the Burp Suite application. You can access the download page from here:
When you visit the above link, you will encounter several versions. It is recommended to decide which version to download based on your own needs.
- Professional
- Community
- Enterprise (out of scope): This product is designed for large companies to run Burp Scanner on thousands of targets.
- Scary (not covered): This version only provides Burp Scanner capabilities and is specifically designed to integrate with Jenkins and other CI tools as jobs in the DevOps channel.
(At the time of writing this article, the price of the Professional version was $449.) You can purchase it from this link.
While the Community version provides many of the functions used in this article series, it lacks some features. For example, the Community version does not include any scanning functions. Additionally, the Community version includes some mandatory thread restrictions when using the Burp Suite Intruder function. There is no built-in data in the Community version, but you can load custom data. Finally, various Burp Suite extensions that require the Professional version do not work in the Community version.
All functions, including passive and active scanners, are enabled in the Professional version. PortSwigger, the company behind Burp Suite, provides various built-in data for fuzzing and brute force. Burp Suite extensions that use browser-related API calls also work in the Professional version.
In this article series, we will use the Professional version, which provides access to a wide range of functions compared to the Community version.
Go to https://portswigger.net/burp and download the Burp Suite version you want to use.
Before purchasing the Professional version, you may also prefer the Community version to familiarize yourself with Burp Suite.
If you choose to purchase or use the trial version of the Professional edition, you will need to fill out forms or complete payments, and then email confirmations will be sent to you. After creating your account, you can log in and proceed with the download process using the links provided in your account.