Burp Suite

v2024.5 (Community-equivalent surface)PortSwigger

The web tester's workbench: intercept requests, replay and mutate them in Repeater, fuzz with Intruder, decode tokens, and follow the site map. The range provides the interception and repeater workflow against in-range applications — the same request/response loop, driven by the authored fixtures.

Category: Web application security testing
Package: burpsuite
Runs on: Linux · Windows
Commands: burpsuite, burp

Requests are answered by the scenario's authored web services. Nothing proxies real browser traffic.

Install it

The scripts below install the real PortSwigger package on your own machine — read them first, and run them somewhere you are allowed to change. Inside the range, one press puts the simulated package on your next machine.

Linux installer (shell script)

install-burp.sh

Burp Suite is delivered as Vendor installer, so it cannot be installed unattended. Follow the steps on the package page instead.

Windows installer (PowerShell)

Install-burp.ps1

Burp Suite has no unattended Windows install. Follow the steps on the package page.

On a range machine

Add it to your kit and every machine you launch comes with it.

On Linux

Vendor installer

Licensed product
PortSwigger ships its own installer behind a license. The range provides the console pre-installed so you can practice the workflow.

Check it worked

Confirm it landed on PATH
```
which burpsuite
```
Check the version
```
burpsuite --version
```
The range reports 2024.5 (Community-equivalent surface).

Remove it

Take it off again
```
sudo apt remove --purge burpsuite
```

On Windows

Vendor installer

Licensed product
PortSwigger ships a signed Windows installer behind a license. The range provides the console pre-installed.

Check it worked

Confirm it resolves
```
where burpsuite
```
Check the version
```
burpsuite --version
```
The range reports 2024.5 (Community-equivalent surface).

Remove it

Take it off again

Remove-Item -Recurse -Force C:\Tools\burpsuite

Inside the range

Tick it on the launch screen
Under Burp Suite's category on the advanced tool shelf. A lab that depends on it locks the toggle on and says why.
Or install it from a range terminal
```
sudo apt install -y burpsuite
```
The simulated package manager seeds the same binaries, config and receipt the shelf toggle does.
Everything here is simulated
No software is downloaded and nothing executes — the range answers from authored fixtures.

Labs that use Burp Suite

Pentest: Web App Assessment (OWASP Top 10)Assess a storefront with the Burp-lite workbench at /pentest/proxy: repeat a login, fuzz an id parameter, catch an IDOR and a stored XSS, and file each finding under its OWASP Top 10 category.