Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Need to know: Burp Suite Professional VAPT Coverage

Nishith | Last updated: Sep 14, 2024 12:15PM UTC

Hello, As per the client's requirements, I'd like to perform Whitebox testing using Burp Suite Professional. However, prior buying license, I need to know if it supports below-listed VAPT requirements. Front-end Application Assessment: Grey-box Security Test Approach * Assessment should be done authenticated for it every user role (e.g., Superadmin, Admin, Maker, Checker, Viewer, etc.). * Assessment should cover all login page security checks. * OWASP Top 10 attacks should be considered. * Assessment should include use cases of business logics inside applications. * Identified loopholes should be exploited (if possible) to gauge depth of impact. * Assessment is suggested to perform on UAT/Test/Pre-Prod environments to freely cover major attacks like, Request Bombing, Payload Injection, DOS, etc. * Static and Dynamic both assessments must be performed on Mobile applications. * If mobile applications are SSL-pinned, tests to be carried out bypassing/disabling SSL- pinning Moreover, is a single user "burp suite pro" license enough to perform all above listed operations on multiple websites? Do I need to renew license every year or it's a onetime purchase only?

Dominyque, PortSwigger Agent | Last updated: Sep 17, 2024 12:20PM UTC

Hi Nishith Can you please expand on what you mean when you say "Assessment should cover all login page security checks." Can you please email support@portswigger.net so we can gather more information from you?

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.