Burp Suite

http://www.portswigger.net/suite/

Burp Suite is an integrated platform for attacking web applications. It contains all of the Burp tools with numerous interfaces between them designed to facilitate and speed up the process of attacking an application. All tools share the same robust framework for handling HTTP requests, persistence, authentication, downstream proxies, logging, alerting and extensibility. Burp Suite allows you to combine manual and automated techniques to enumerate, analyse, scan, attack and exploit web applications. The various Burp tools work together effectively to share information and allow findings identified within one tool to form the basis of an attack using another.
Key features unique to Burp Suite include:

• Detailed analysis and rendering of requests and responses.
• One-click transfer of interesting requests between tools.
• Ability to "passively" spider an application in a non-intrusive manner, with all requests originating from the user's browser.
• FIPS-compliant statistical analysis of session token randomness.
• Utilities for decoding and comparing application data.
• Support for custom client and server SSL certificates.
• Extensibility via the IBurpExtender interface.
• Centrally configured settings for downstream proxies, web and proxy authentication, and logging.
• Tools can run in a single tabbed window, or be detached in individual windows.
• Runs in both Linux and Windows.

New features in version 1.2 include:

• Site map showing information accumulated about target applications in tree and table form.
• Fully fledged web vulnerability scanner. [Pro version only]
• Suite-level target scope configuration, driving numerous individual tool actions.
• Display filters on site map and Proxy request history.
• Ability to save and restore state. [Pro version only]
• Suite-wide search function.
• Support for invisible proxying.

Burp Suite is a Java application, and runs on any platform for which a Java Runtime Environment is available. It requires version 1.5 or later.

Burp Suite contains the following tools:

• Proxy - an intercepting HTTP/S proxy server which operates as a man-in-the-middle between the end browser and the target web application, allowing you to intercept, inspect and modify the raw traffic passing in both directions.
• Spider - an intelligent application-aware web spider which allows complete enumeration of an application's content and functionality.
• Scanner [professional version only] - an advanced tool for performing automated discovery of security vulnerabilities in web applications.
• Intruder - a highly configurable tool for automating customised attacks against web applications, such as enumerating identifiers, harvesting useful data, and fuzzing for common vulnerabilities.
• Repeater - a tool for manually manipulating and re-issuing individual HTTP requests, and analysing the application's responses.
• Sequencer - a tool for analysing the quality of randomness in an application's session tokens or other important data items which are intended to be unpredictable.
• Decoder - a tool for performing manual or intelligent decoding and encoding of application data.
• Comparer - a utility for performing a visual "diff" between any two items of data, normally pairs of related requests and responses.

Using Burp Suite

When Burp Suite is launched, Burp Proxy is started by default on port 8080 of the local loopback interface. By setting a web browser to use this as its proxy server, all web traffic can be intercepted, inspected and modified.


...
...
...

Current version: 1.2

Home Page: http://www.portswigger.net/suite/
Download: http://www.portswigger.net/suite/download.html
Help: http://www.portswigger.net/suite/help.html
Screenshots: http://www.portswigger.net/suite/screenshots.html