Vendor lineage
PortSwigger - the consultant's side project that became the standard
Dafydd Stuttard wrote tools to speed up his own consulting in a Cheshire market town, gave one of them an arbitrary name, and it became the default instrument of web application testing.
PortSwigger is a British software company founded by security consultant Dafydd Stuttard, maker of Burp Suite, the web application security testing toolkit.
The origin is the most ordinary one in this catalogue and produced one of its least ordinary outcomes. Dafydd Stuttard was a security consultant living in Knutsford, a market town in Cheshire, doing the work consultants do for a series of clients. The routine parts of that work were repetitive, so he wrote small programs to speed them up, gave each one an arbitrary name, used it for a while and moved on. He shared them occasionally with a community that already knew him as an author and practitioner.
One of them was called Burp, for no particular reason at all, and the early versions made actual burping sounds. Version 1.0 was released in June 2003 as the first incarnation of the Intruder tool; the separate pieces - a proxy, a spider, a repeater - were unified into a suite by 2005, and automated scanning arrived in 2008. What made it the standard was not the scanner. It was the proxy: a tool that lets a tester see and modify every request between browser and application, which is the irreducible operation of web application testing and something no automated product replaces.
The company's structure is worth noting for anyone who teaches. A free Community edition keeps the manual tools available to students, self-taught practitioners and anyone whose employer will not pay, while the Professional and Enterprise editions carry the automation that a consultancy bills for. That arrangement, plus the Web Application Hacker's Handbook that Stuttard co-wrote, means the same person supplied a generation with both the instrument and the textbook - and the free tier is why the instrument is what people learn on.
The relevant caution belongs with the tool rather than the company, and the interception article on this site makes it: an intercepting proxy is technically identical whether the person running it was authorised or not. What separates a test from an intrusion is a scope document and a signature, which is why the professional discipline around this product is procedural rather than technical.
- PortSwigger's own history page: Dafydd Stuttard writes the first version of Burp, with actual burping sounds; Burp Suite v1.0 launches including Burp Proxy, Spider and Repeater; the first edition of the Web Application Hacker's Handbook reaches over 100,000 security professionals
- Dafydd Stuttard, Burp through the ages, October 2013: Burp v1.0 released June 2003, the first incarnation of the Intruder tool
- TechCrunch, June 2024: Stuttard, known as Daf, was working as a security consultant for various clients while living in Knutsford, Cheshire, building tools on the side to speed up routine parts of his work; he gave each a random name and moved on, and one - named Burp for no specific reason at all - was shared with his community; the company raised 112 million dollars
- Grokipedia: Burp Suite originated as individual tools created by Stuttard in 2003 to automate his own web security testing, with the first release of Burp Intruder and Burp Proxy that year; the components were unified into Burp Suite version 1.0 in 2005 and automated scanning was added in 2008; the suite is offered as a free Community Edition alongside Professional and Enterprise