{"slug": "burp-suite", "name": "Burp Suite", "category": "security", "category_name": "Security and passwords", "description": "", "recommenders": 4, "commenters": 10, "warners": 0, "score": 4.762, "rising": -1.31, "first": "2025-12-19", "latest": "2026-10-01", "why": "You can get the whole auth flow and initial conversation starters using Burp Suite", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 4, "neutral": 8, "compare": 2, "warn": 0}, "spark": [0, 2, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "You can get the whole auth flow and initial conversation starters using Burp Suite", "kind": "", "icon": true, "domain": "portswigger.net", "github_repo": null, "official_url": "https://portswigger.net/burp", "pricing": "", "aliases": ["Burp Suite"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 749629186, "item_id": 46851824, "url": "https://news.ycombinator.com/item?id=46851824", "by": "guessmyname", "date": "2026-02-01", "version": null, "stance": "recommend", "quote": "You can easily inspect the packet with tools like Wireshark or Burp Suite Professional", "excerpt": "I don\u2019t get it, why don\u2019t you all\u2014absolutely all of you reading\u2014use Little Snitch? [1] It really doesn\u2019t compute in my head why would any macOS user not use a network firewall like this, or similar, to block unwanted outgoing HTTP(s) requests. You can easily inspect the packet with tools like Wireshark or Burp Suite Professional (or Community) edition, or any other proxy tool, of which there are many in the macOS eco", "context": "", "use_case": "", "switched_from": "", "story": "Notepad++ hijacked by state-sponsored actors"}, {"id": 748835058, "item_id": 46802191, "url": "https://news.ycombinator.com/item?id=46802191", "by": "tkp-415", "date": "2026-01-28", "version": null, "stance": "recommend", "quote": "You can get the whole auth flow and initial conversation starters using Burp Suite", "excerpt": "Curious to see how you can get Gemini fully intercepted. I've been intercepting its HTTP requests by running it inside a docker container with: -e HTTP_PROXY=http://127.0.0.1:8080 -e HTTPS_PROXY=http://host.docker.internal:8080 -e NO_PROXY=localhost,127.0.0.1 It was working with mitmproxy for a very brief period, then the TLS handshake started failing and it kept requesting for re-authentication when proxied. You can", "context": "", "use_case": "HTTP traffic inspection", "switched_from": "", "story": "A MitM proxy to see what your LLM tools are sending"}, {"id": 741394673, "item_id": 46337167, "url": "https://news.ycombinator.com/item?id=46337167", "by": "Fnoord", "date": "2025-12-20", "version": null, "stance": "recommend", "quote": "it is Burp Suite, sadly", "excerpt": "mitmproxy isn't the gold standard; it is Burp Suite, sadly. Burp Suite uses a subscription model. Charles a model like Sublime Text: you buy it and get to keep the version forever, major upgrades available for a discount. I had to chuckle at this one: > If you purchased a Charles license prior to 1 May 2008 your existing license key is still valid for Charles 5. So I guess in past they used a model where you'd have l", "context": "", "use_case": "", "switched_from": "", "story": "Charles Proxy"}, {"id": 741347456, "item_id": 46334216, "url": "https://news.ycombinator.com/item?id=46334216", "by": "efortis", "date": "2025-12-19", "version": null, "stance": "recommend", "quote": "Burp is free too (community edition)", "excerpt": "Burp is free too (community edition) https://portswigger.net/burp/communitydownload", "context": "", "use_case": "HTTP proxy / web security testing", "switched_from": "", "story": "Charles Proxy"}]}], "caveats": [], "who": [{"by": "b8", "context": "security analyst job seeker", "url": "https://news.ycombinator.com/item?id=49926178", "date": "2026-10-01"}], "tags": [], "use_cases": ["web security testing", "security testing", "capturing http traffic for pentesting", "web security testing proxy", "http traffic inspection", "http proxy / web security testing"], "compared": [{"slug": "binary-ninja", "name": "Binary Ninja", "co": 5, "switched_from": 0, "switched_to": 0}, {"slug": "charles-proxy", "name": "Charles Proxy", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "little-snitch", "name": "Little Snitch", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "mitmproxy", "name": "mitmproxy", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "wireshark", "name": "Wireshark", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "amazon-web-services", "name": "Amazon Web Services", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [{"id": 798836240, "item_id": 49927265, "url": "https://news.ycombinator.com/item?id=49927265", "by": "ATocqueville", "date": "2026-10-01", "version": null, "stance": "recommend", "quote": "Portswigger makes the most widely used pentesting suite in the world, the Burp Suite.", "excerpt": "Portswigger | https://portswigger.net/ | Knutsford, UK | Full Time | Onsite | \u00a380,000-150,000 Portswigger makes the most widely used pentesting suite in the world, the Burp Suite. We have fully embraced AI and are using it to both offer agentic solutions in Burp AT and completely rewire how the company itself works. Doing this requires instinctive builders who can't see an inefficiency without needing to rationalise ", "context": "", "use_case": "", "switched_from": "", "story": "Ask HN: Who is hiring? (October 2026)"}], "threads": [{"url": "https://news.ycombinator.com/item?id=46333983", "title": "Charles Proxy", "mentions": 4}, {"url": "https://news.ycombinator.com/item?id=46851548", "title": "Notepad++ hijacked by state-sponsored actors", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=49922569", "title": "Ask HN: Who is hiring? (October 2026)", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49922568", "title": "Ask HN: Who wants to be hired? (October 2026)", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49727521", "title": "BurpSqueezer \u2013 Turn Burp Suite XML Dumps into Compact LLM-Ready Markdown", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49599913", "title": "Do We Still Need Burp Suite for Web Security Testing?", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {"recommend": 2, "neutral": 1, "compare": 1}, "2026-01": {"recommend": 1}, "2026-02": {"recommend": 1, "neutral": 2}, "2026-03": {"neutral": 1}, "2026-04": {}, "2026-05": {"neutral": 1}, "2026-06": {"neutral": 1}, "2026-07": {}, "2026-08": {}, "2026-09": {"compare": 1, "neutral": 1}, "2026-10": {"neutral": 1}}, "versions": [], "version_unnamed": 0, "family_ref": null, "runs_on": null, "lines": [], "quotes": [{"id": 798818848, "item_id": 49926178, "url": "https://news.ycombinator.com/item?id=49926178", "by": "b8", "date": "2026-10-01", "version": null, "stance": "neutral", "quote": "Burp Suite, Binary Ninja etc.", "excerpt": "Seeking: Any role that I can use my technical skills in. Security analyst, consultant, technical support etc. Location: Louisiana Remote: Yes, and/or on-site. I'm experienced with both. Willing to relocate: Yes Technologies: AWS, Java (SRC review), C++/C (SRC Review), C# (Basic), Burp Suite, Binary Ninja etc. R\u00e9sum\u00e9/CV: Full resume on request. Email: mcorkern1@tulane.edu GitHub: https://github.com/qf0 Misc: I have ov", "context": "security analyst job seeker", "use_case": "security testing", "switched_from": "", "story": "Ask HN: Who wants to be hired? (October 2026)"}, {"id": 795640353, "item_id": 49727522, "url": "https://news.ycombinator.com/item?id=49727522", "by": "vaginskii", "date": "2026-09-16", "version": null, "stance": "neutral", "quote": "I wanted AI to be able to work with real Burp traffic", "excerpt": "Hi, everyone. I\u2019ve put together a tool that will help many web and API penetration testers solve the problem of integrating AI into their workflow. BurpSqueezer is a utility that lets you \u201ccompress\u201d the HTTP traffic you need for your work (which can take up tens or even hundreds of megabytes) into a small `.md` report, generated specifically for AI processing. I haven\u2019t hardcoded anything into the code. (Well, almost", "context": "", "use_case": "capturing HTTP traffic for pentesting", "switched_from": "", "story": "BurpSqueezer \u2013 Turn Burp Suite XML Dumps into Compact LLM-Ready Markdown"}, {"id": 793602864, "item_id": 49600179, "url": "https://news.ycombinator.com/item?id=49600179", "by": "danieltk76", "date": "2026-09-07", "version": null, "stance": "compare", "quote": "I could see the value of using burp as a way to have a GUI look at what your agent is doing", "excerpt": "I could see the value of using burp as a way to have a GUI look at what your agent is doing, but I know at Vulnetic and other ai security vendors we use our own proxies or custom scripting rather than burp.", "context": "works at an AI security vendor", "use_case": "web security testing proxy", "switched_from": "", "story": "Do We Still Need Burp Suite for Web Security Testing?"}, {"id": 773809504, "item_id": 48363094, "url": "https://news.ycombinator.com/item?id=48363094", "by": "b8", "date": "2026-06-01", "version": null, "stance": "neutral", "quote": "Technologies: AWS, Java (SRC review), C++/C (SRC Review), C# (Basic), Burp Suite, Binary Ninja etc.", "excerpt": "Seeking: Any role that I can use my technical skills in. Security analyst, consultant, technical support etc. Location: Louisiana Remote: Yes, and/or on-site. I'm experienced with both. Willing to relocate: Yes Technologies: AWS, Java (SRC review), C++/C (SRC Review), C# (Basic), Burp Suite, Binary Ninja etc. R\u00e9sum\u00e9/CV: Full resume on request. Email: mcorkern1@tulane.edu GitHub: https://github.com/qf0 Misc: I have ov", "context": "", "use_case": "", "switched_from": "", "story": "Ask HN: Who wants to be hired? (June 2026)"}, {"id": 769052448, "item_id": 48065778, "url": "https://news.ycombinator.com/item?id=48065778", "by": "b8", "date": "2026-05-08", "version": null, "stance": "neutral", "quote": "Burp Suite", "excerpt": "Seeking: Any role that I can use my technical skills in. Security analyst, consultant, technical support etc. Location: Louisiana Remote: Yes, and/or on-site. I'm experienced with both. Willing to relocate: Yes Technologies: AWS, Java (SRC review), C++/C (SRC Review), C# (Basic), Burp Suite, Binary Ninja etc. R\u00e9sum\u00e9/CV: Full resume on request. Email: mcorkern1@tulane.edu GitHub: https://github.com/qf0 Misc: I have ov", "context": "security consultant, two years at NCC Group and Black Lantern Security", "use_case": "Web security testing", "switched_from": "", "story": "Ask HN: Who wants to be hired? (May 2026)"}, {"id": 755554161, "item_id": 47222135, "url": "https://news.ycombinator.com/item?id=47222135", "by": "b8", "date": "2026-03-02", "version": null, "stance": "neutral", "quote": "Burp Suite, Binary Ninja", "excerpt": "Seeking: Any role that I can use my technical skills in. Security analyst, consultant, technical support etc. Location: Louisiana Remote: Yes, and/or on-site. I'm experienced with both. Willing to relocate: Yes Technologies: AWS, Java (SRC review), C++/C (SRC Review), C# (Basic), Burp Suite, Binary Ninja etc. R\u00e9sum\u00e9/CV: Full resume on request. Email: mcorkern1@tulane.edu GitHub: https://github.com/qf0 Misc: I have ov", "context": "security consultant, 2+ years blue team", "use_case": "", "switched_from": "", "story": "Ask HN: Who wants to be hired? (March 2026)"}, {"id": 749734112, "item_id": 46858382, "url": "https://news.ycombinator.com/item?id=46858382", "by": "b8", "date": "2026-02-02", "version": null, "stance": "neutral", "quote": "Burp Suite, Binary Ninja etc.", "excerpt": "Seeking: Any role that I can use my technical skills in. Security analyst, consultant, technical support etc. Location: Louisiana Remote: Yes, and/or on-site. I'm experienced with both. Willing to relocate: Yes Technologies: AWS, Java (SRC review), C++/C (SRC Review), C# (Basic), Burp Suite, Binary Ninja etc. R\u00e9sum\u00e9/CV: Full resume on request. Email: mcorkern1@tulane.edu GitHub: https://github.com/qf0 Misc: I have ov", "context": "two years security consulting and blue team", "use_case": "Web security testing", "switched_from": "", "story": "Ask HN: Who wants to be hired? (February 2026)"}, {"id": 749662403, "item_id": 46853900, "url": "https://news.ycombinator.com/item?id=46853900", "by": "efreak", "date": "2026-02-02", "version": null, "stance": "neutral", "quote": "", "excerpt": "I used to love Zone Alarm's ability to notify me on an application's first attempt to connect to the internet, and allow me to approve or deny it. I really wish there was still such an interface today. Having said that, I absolutely despised the implementation that stole keyboard focus; if it popped up when I was typing it frequently disappeared before I head a chance to read it and I had to go into settings to try a", "context": "", "use_case": "", "switched_from": "", "story": "Notepad++ hijacked by state-sponsored actors"}, {"id": 749629186, "item_id": 46851824, "url": "https://news.ycombinator.com/item?id=46851824", "by": "guessmyname", "date": "2026-02-01", "version": null, "stance": "recommend", "quote": "You can easily inspect the packet with tools like Wireshark or Burp Suite Professional", "excerpt": "I don\u2019t get it, why don\u2019t you all\u2014absolutely all of you reading\u2014use Little Snitch? [1] It really doesn\u2019t compute in my head why would any macOS user not use a network firewall like this, or similar, to block unwanted outgoing HTTP(s) requests. You can easily inspect the packet with tools like Wireshark or Burp Suite Professional (or Community) edition, or any other proxy tool, of which there are many in the macOS eco", "context": "", "use_case": "", "switched_from": "", "story": "Notepad++ hijacked by state-sponsored actors"}, {"id": 748835058, "item_id": 46802191, "url": "https://news.ycombinator.com/item?id=46802191", "by": "tkp-415", "date": "2026-01-28", "version": null, "stance": "recommend", "quote": "You can get the whole auth flow and initial conversation starters using Burp Suite", "excerpt": "Curious to see how you can get Gemini fully intercepted. I've been intercepting its HTTP requests by running it inside a docker container with: -e HTTP_PROXY=http://127.0.0.1:8080 -e HTTPS_PROXY=http://host.docker.internal:8080 -e NO_PROXY=localhost,127.0.0.1 It was working with mitmproxy for a very brief period, then the TLS handshake started failing and it kept requesting for re-authentication when proxied. You can", "context": "", "use_case": "HTTP traffic inspection", "switched_from": "", "story": "A MitM proxy to see what your LLM tools are sending"}, {"id": 741394673, "item_id": 46337167, "url": "https://news.ycombinator.com/item?id=46337167", "by": "Fnoord", "date": "2025-12-20", "version": null, "stance": "recommend", "quote": "it is Burp Suite, sadly", "excerpt": "mitmproxy isn't the gold standard; it is Burp Suite, sadly. Burp Suite uses a subscription model. Charles a model like Sublime Text: you buy it and get to keep the version forever, major upgrades available for a discount. I had to chuckle at this one: > If you purchased a Charles license prior to 1 May 2008 your existing license key is still valid for Charles 5. So I guess in past they used a model where you'd have l", "context": "", "use_case": "", "switched_from": "", "story": "Charles Proxy"}, {"id": 741383953, "item_id": 46336497, "url": "https://news.ycombinator.com/item?id=46336497", "by": "Sytten", "date": "2025-12-20", "version": null, "stance": "compare", "quote": "Most of the Burp new features of the last 2 years are basically copying what we innovated in Caido.", "excerpt": "You can also check out Caido as an alternative, we are a newer player in the space but catching up very fast. Most of the Burp new features of the last 2 years are basically copying what we innovated in Caido.", "context": "", "use_case": "", "switched_from": "", "story": "Charles Proxy"}, {"id": 741365953, "item_id": 46335372, "url": "https://news.ycombinator.com/item?id=46335372", "by": "doomerhunter", "date": "2025-12-20", "version": null, "stance": "neutral", "quote": "I am a Burp guy", "excerpt": "I am a Burp guy, but lately Caido[1] has been trending, pretty lightweight and can be ran in headless mode. It's still very security-oriented (as Burp Suite is), but might be worth your time, notably as you can run it on a VPS/container to proxy all your traffic through it (which is by-design, contrary to my beloved burp/zap) [1] https://caido.io/", "context": "", "use_case": "", "switched_from": "", "story": "Charles Proxy"}, {"id": 741347456, "item_id": 46334216, "url": "https://news.ycombinator.com/item?id=46334216", "by": "efortis", "date": "2025-12-19", "version": null, "stance": "recommend", "quote": "Burp is free too (community edition)", "excerpt": "Burp is free too (community edition) https://portswigger.net/burp/communitydownload", "context": "", "use_case": "HTTP proxy / web security testing", "switched_from": "", "story": "Charles Proxy"}]}