Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Need to know: Burp Suite Professional VAPT Coverage

Nishith | Last updated: Sep 14, 2024 12:15PM UTC

Hello, As per the client's requirements, I'd like to perform Whitebox testing using Burp Suite Professional. However, prior buying license, I need to know if it supports below-listed VAPT requirements. Front-end Application Assessment: Grey-box Security Test Approach * Assessment should be done authenticated for it every user role (e.g., Superadmin, Admin, Maker, Checker, Viewer, etc.). * Assessment should cover all login page security checks. * OWASP Top 10 attacks should be considered. * Assessment should include use cases of business logics inside applications. * Identified loopholes should be exploited (if possible) to gauge depth of impact. * Assessment is suggested to perform on UAT/Test/Pre-Prod environments to freely cover major attacks like, Request Bombing, Payload Injection, DOS, etc. * Static and Dynamic both assessments must be performed on Mobile applications. * If mobile applications are SSL-pinned, tests to be carried out bypassing/disabling SSL- pinning Moreover, is a single user "burp suite pro" license enough to perform all above listed operations on multiple websites? Do I need to renew license every year or it's a onetime purchase only?

Dominyque, PortSwigger Agent | Last updated: Sep 17, 2024 12:20PM UTC