What it does
Burp Suite Professional is PortSwigger's paid toolkit for hands-on testing of web applications. A tester can route browser traffic through its proxy, inspect and modify HTTP requests, set a target scope, and use the scanner alongside manual testing tools. It is aimed at security testers and application teams validating web behavior, not at general uptime monitoring or browser functional-test suites.
Start from a request you are authorized to test
Install Burp, configure a test browser to use its proxy, and browse the application so requests appear for inspection. The official getting-started guide then walks through modifying and reissuing requests, setting the target scope, and running a first scan, which is a Professional-only step in that guide. A useful first exercise is to inspect one request from a staging application, change a parameter, and compare the response before expanding to a scoped scan. That example is illustrative; no application was scanned for this listing.
Burp Pro is the paid desktop edition. PortSwigger separately presents Burp Suite Community Edition for manual testing and Burp Suite DAST for enterprise-enabled scanning, so those products should not be treated as included in the Pro license. The official purchase page describes a subscription and also offers a free-trial route. It displays a price, but the pages opened did not establish its billing interval, commitment, or regional terms, so no amount is repeated here.
The system-requirements guide distinguishes basic proxying from concurrent or large automated scans: more demanding workloads need more CPU, memory, and disk space. Check the target and machine requirements before scheduling broad scans.
Strengths
- The proxy workflow lets a tester inspect, modify, and reissue application requests before making scan decisions.
- Professional adds an automated scanner to a toolkit that also supports manual web testing.
- The official getting-started guide covers target scope, request modification, and a first scan.
Watch out for
- Concurrent or large automated scans can need substantially more CPU, memory, and project disk space than basic proxying.
Best for
- Security testers examining and manually validating web-application requests
- Application teams combining request-level investigation with DAST scans on a controlled target
- Pentesters who need a desktop proxy and scanner in one toolkit
Sources
- Burp Suite Professional - PortSwigger (Oct 26, 2026)
- Getting started with Burp Suite Professional / Community Edition - PortSwigger (Oct 26, 2026)
- Subscribe to Burp Suite Professional - PortSwigger (Oct 26, 2026)
- Burp Suite system requirements - PortSwigger (Oct 26, 2026)