Burp Suite for QA: where it is used, what it pays, how to learn it
Burp Suite is the standard intercepting-proxy toolkit for web security testing, made by PortSwigger. It sits between the browser and the app so you can inspect, modify and replay traffic. 43 of the 4,012 QA listings we track mention it, about 30% of them remote. Posted pay for those listings has a median of $156k a year.
Middle half $145k to $260k, from 8 listings with a published range.
What Burp Suite is used for in QA
Burp Suite is the standard intercepting-proxy toolkit for web security testing, made by PortSwigger. It sits between the browser and the app so you can inspect, modify and replay traffic.
- Manual web application penetration testing.
- Replaying and tampering with requests to find access-control and logic flaws.
- Automated scanning of web apps with the Professional edition.
- Extending with BApp Store extensions and custom scripts.
Top countries in our listings
- United States17
- India4
- Switzerland3
Which roles use Burp Suite
Pay is the US median for a mid-level hire. Other levels and countries are on each role's page.
| Role | What they do with it | Junior | Mid | Senior |
|---|---|---|---|---|
| Security / Penetration Tester | Attacks applications before someone else does, then helps fix what breaks. | $140k | $181k | $231k |
US gross annual median, estimate from our salary model. All salary guides.
Listings that mention Burp Suite
Senior QA Automation Engineer
Mobile App Penetration Tester
Lead Pentester / Manager Audit Technique F/H - CDI
Application Security Specialist (a) 80-100%
Application Security Architect (a) 80-100%
AppSec Staff Engineer
Learn Burp Suite in five steps
A practical order that gets you to a working project. Build something at each step; reading alone does not stick.
- 1
Set up the proxy
Configure the browser and Burp's CA certificate and browse the target through the proxy.
- 2
Repeater and Intruder
Replay and mutate requests, and fuzz parameters in scope.
- 3
Learn the vulnerability classes
Work through injection, XSS, access control and authentication labs in the Web Security Academy.
- 4
Scanning and extensions
Run scans on authorised targets and add extensions such as Autorize.
- 5
Report findings
Document reproduction steps, impact and fixes in a clear report.
Burp Suite vs OWASP ZAP
| Aspect | Burp Suite | OWASP ZAP |
|---|---|---|
| Cost | Free Community, paid Professional | Free and open source |
| Manual testing | Industry standard | Capable, less polished |
| Automation in CI | Enterprise edition | Baseline and API scans in Docker |
| Extensions | BApp Store | Marketplace add-ons |
Choose Burp Suite when
You do manual penetration tests and want the most refined proxy and scanner.
Interview questions about Burp Suite
Questions from our Interview Vault that test Burp Suite knowledge. Answer aloud first, then reveal the model answer.
Explain authentication versus authorization with an IDOR example.
Authentication proves who you are; authorization decides what you may do. In an IDOR, GET /invoices/1042 returns another customer's invoice because the server checks that you are logged in but not that you own the record. Test by replaying requests with a second account's session and swapped identifiers.
Security / Penetration Tester · Junior · Access control
How do you confirm SQL injection when the application returns no errors?
Use boolean-based tests where true and false conditions change the response, time-based tests (SLEEP or pg_sleep) and out-of-band interactions. Stay within the agreed scope. The fix is parameterised queries, not input filtering.
Security / Penetration Tester · Mid · Injection
How strong is your Burp Suite experience on paper?
Run your CV through the checker for Burp Suite keywords and results, or take the 10-minute level test.
Burp Suite FAQ
Is Burp Suite legal to use?
Only against systems you own or have written permission to test. Unauthorised testing is illegal in most countries.
Community or Professional?
Community is enough to learn the proxy, Repeater and basic manual work. Professional adds the automated scanner, a full Intruder and project saving.
How much do jobs that ask for Burp Suite pay?
Listings that mention Burp Suite and publish a pay range have a median of about $156k a year in USD terms (middle half $145k to $260k, from 8 posted ranges).
Which QA roles use Burp Suite?
Roles that use it: Security / Penetration Tester (US median $181k mid-level).