---
title: "What is Burp Suite? | Daniel Christensen"
description: "The tool most pentesters use against web applications: it lets you see and modify all traffic between the browser and the server."
canonical_url: "https://danielchristensen.no/en/glossary/burp-suite"
last_updated: "2026-09-07T12:05:01.262Z"
locale: en
meta:
  "og:description": "The tool most pentesters use against web applications: it lets you see and modify all traffic between the browser and the server."
  "og:image": "https://danielchristensen.no/_og/d/c_Default%2Ctitle_Burp%2BSuite%2Csubtitle_Glossary%2Ctagline_~RXRoaWNhbCBoYWNrZXIgwrcgU3BlYWtlcg%2Cp_Ii9lbi9nbG9zc2FyeS9idXJwLXN1aXRlIg%2Cs_y6IHLnI76KRE2JeH.png"
  "og:image:height": "600"
  "og:image:type": image/png
  "og:image:width": "1200"
  "og:title": "What is Burp Suite?"
  "twitter:image": "https://danielchristensen.no/_og/d/c_Default%2Ctitle_Burp%2BSuite%2Csubtitle_Glossary%2Ctagline_~RXRoaWNhbCBoYWNrZXIgwrcgU3BlYWtlcg%2Cp_Ii9lbi9nbG9zc2FyeS9idXJwLXN1aXRlIg%2Cs_y6IHLnI76KRE2JeH.png"
---

> Index of every page on this site: [llms.txt](https://danielchristensen.no/llms.txt)

[← All terms](https://danielchristensen.no/en/glossary)Glossary

# Burp Suite

The tool most pentesters use against web applications: it lets you see and modify all traffic between the browser and the server.

Also called: Burp

Burp Suite is a proxy that sits between the browser and the web application being tested. All traffic can be inspected, modified and replayed, which is how you find the flaws that never show up in the browser itself: missing access control, insecure API calls and logic holes.

For me, Burp is the workbench in practically every web application pentest. The tool is legal and freely available, but like everything else in this glossary it must only be used against systems you have permission to test.

In practice every single request the browser sends is captured and can be changed before it continues. That’s where the interesting flaws turn up. The button hidden in the interface still exists in the API behind it, and the field that only accepts numbers in the browser will happily accept anything when the check lives on the outside only.

There’s a free edition that carries you a long way while learning, and a paid one with automated scanning. For developers, the point of knowing the tool isn’t to become a pentester, it’s to understand that everything happening in the browser can be changed by whoever is sitting there. Validation and access control belong on the server, every time, without exception.

See also: [See talks on digital security](https://danielchristensen.no/en/talks)

Next step

## Want this explained live?

My talks take the terms from this list and show what they mean in practice, with real examples and demos the room remembers.

[See the talks →](https://danielchristensen.no/en/talks) [Try the password generator](https://danielchristensen.no/en/tools/password-generator)

```json
{"@context":"https://schema.org","@graph":[{"@id":"https://danielchristensen.no/en#website","@type":"WebSite","description":"Ethical hacker and keynote speaker. Talks on digital security, pentesting and how to avoid getting hacked.","inLanguage":"en","name":"Daniel Christensen","url":"https://danielchristensen.no/en","publisher":{"@id":"https://danielchristensen.no/#identity"},"translationOfWork":{"@id":"https://danielchristensen.no/#website"}},{"@id":"https://danielchristensen.no/en/glossary/burp-suite#webpage","@type":"WebPage","description":"The tool most pentesters use against web applications: it lets you see and modify all traffic between the browser and the server.","name":"What is Burp Suite?","url":"https://danielchristensen.no/en/glossary/burp-suite","breadcrumb":{"@id":"https://danielchristensen.no/en/glossary/burp-suite#/schema/breadcrumb-list/#breadcrumb"},"isPartOf":{"@id":"https://danielchristensen.no/en#website"},"potentialAction":[{"@type":"ReadAction","target":["https://danielchristensen.no/en/glossary/burp-suite"]}]},{"@id":"https://danielchristensen.no/#identity","@type":"Person","alternateName":"BobTheShoplifter","description":"Ethical hacker, speaker and content creator (BobTheShoplifter). Talks on digital security and pentesting.","name":"Daniel Christensen","url":"https://danielchristensen.no","address":{"@type":"PostalAddress","addressLocality":"Oslo","addressRegion":"Oslo","addressCountry":"NO"},"contactPoint":{"@type":"ContactPoint","telephone":"+4798332280","email":"daniel@websecured.io","contactType":"booking","areaServed":"NO","availableLanguage":["nb","en"]},"image":{"@id":"https://danielchristensen.no/#/schema/image/1"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"FollowAction"},"userInteractionCount":130500},"jobTitle":["Ethical hacker","Keynote speaker","Content creator"],"knowsAbout":["Digital security","Cybersecurity","Ethical hacking","Penetration testing","Social engineering","Fraud and phishing"],"sameAs":["https://www.wikidata.org/wiki/Q109401760","https://www.tiktok.com/@bobtheshoplifter","https://www.instagram.com/bobtheshoplifter","https://www.youtube.com/channel/UCp2mLClUy4kwbg_uUWbR_5w","https://www.linkedin.com/in/-daniel-/","https://twitter.com/BobTShoplifter","https://www.facebook.com/daniel.christensen.5648/"],"worksFor":{"@type":"Organization","name":"Websecured","url":"https://websecured.io"}},{"@id":"https://danielchristensen.no/en/glossary/burp-suite#/schema/breadcrumb-list/#breadcrumb","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","name":"Home","item":"https://danielchristensen.no/en","position":1},{"@type":"ListItem","name":"Security glossary","item":"https://danielchristensen.no/en/glossary","position":2},{"@type":"ListItem","name":"Burp Suite","item":"https://danielchristensen.no/en/glossary/burp-suite","position":3}]},{"@id":"https://danielchristensen.no/en/glossary/burp-suite#term","@type":"DefinedTerm","description":"The tool most pentesters use against web applications: it lets you see and modify all traffic between the browser and the server.","name":"Burp Suite","url":"https://danielchristensen.no/en/glossary/burp-suite","alternateName":["Burp Suite","Burp"],"inDefinedTermSet":{"@type":"DefinedTermSet","@id":"https://danielchristensen.no/en/glossary#terms","url":"https://danielchristensen.no/en/glossary","name":"Security glossary","inLanguage":"en"}},{"@id":"https://danielchristensen.no/#/schema/image/1","@type":"ImageObject","contentUrl":"https://danielchristensen.no/assets/photos/daniel-portrait.jpg","inLanguage":"en","url":"https://danielchristensen.no/assets/photos/daniel-portrait.jpg"}]}
```

## Sitemap

See the full [sitemap](https://danielchristensen.no/sitemap.md) for all pages.