---
title: "What is Burp Suite? | Daniel Christensen"
canonical_url: "https://danielchristensen.no/en/glossary/burp-suite"
last_updated: "2026-09-02T13:50:00.518Z"
locale: en
meta:
  description: "The tool most pentesters use against web applications: it lets you see and modify all traffic between the browser and the server."
  "og:description": "The tool most pentesters use against web applications: it lets you see and modify all traffic between the browser and the server."
  "og:title": "What is Burp Suite?"
---

[← All terms](https://danielchristensen.no/en/glossary)Glossary

# Burp Suite

The tool most pentesters use against web applications: it lets you see and modify all traffic between the browser and the server.

Also called: Burp

Burp Suite is a proxy that sits between the browser and the web application being tested. All traffic can be inspected, modified and replayed, which is how you find the flaws that never show up in the browser itself: missing access control, insecure API calls and logic holes.

For me, Burp is the workbench in practically every web application pentest. The tool is legal and freely available, but like everything else in this glossary it must only be used against systems you have permission to test.

In practice every single request the browser sends is captured and can be changed before it continues. That’s where the interesting flaws turn up. The button hidden in the interface still exists in the API behind it, and the field that only accepts numbers in the browser will happily accept anything when the check lives on the outside only.

There’s a free edition that carries you a long way while learning, and a paid one with automated scanning. For developers, the point of knowing the tool isn’t to become a pentester, it’s to understand that everything happening in the browser can be changed by whoever is sitting there. Validation and access control belong on the server, every time, without exception.

See also: [See talks on digital security](https://danielchristensen.no/en/talks)

Next step

## Want this explained live?

My talks take the terms from this list and show what they mean in practice, with real examples and demos the room remembers.

[See the talks →](https://danielchristensen.no/en/talks) [Try the password generator](https://danielchristensen.no/en/tools/password-generator)