PortSwigger - the consultant's side project that became the standard - Dafydd Stuttard wrote tools to speed up his own consulting in a Cheshire market town, gave one of them an arbitrary name, and it became the default instrument of web application testing.

PortSwigger is a British software company founded by security consultant Dafydd Stuttard, maker of Burp Suite, the web application security testing toolkit.

The origin is the most ordinary one in this catalogue and produced one of its least ordinary outcomes. Dafydd Stuttard was a security consultant living in Knutsford, a market town in Cheshire, doing the work consultants do for a series of clients. The routine parts of that work were repetitive, so he wrote small programs to speed them up, gave each one an arbitrary name, used it for a while and moved on. He shared them occasionally with a community that already knew him as an author and practitioner.

One of them was called Burp, for no particular reason at all, and the early versions made actual burping sounds. Version 1.0 was released in June 2003 as the first incarnation of the Intruder tool; the separate pieces - a proxy, a spider, a repeater - were unified into a suite by 2005, and automated scanning arrived in 2008. What made it the standard was not the scanner. It was the proxy: a tool that lets a tester see and modify every request between browser and application, which is the irreducible operation of web application testing and something no automated product replaces.

The company's structure is worth noting for anyone who teaches. A free Community edition keeps the manual tools available to students, self-taught practitioners and anyone whose employer will not pay, while the Professional and Enterprise editions carry the automation that a consultancy bills for. That arrangement, plus the Web Application Hacker's Handbook that Stuttard co-wrote, means the same person supplied a generation with both the instrument and the textbook - and the free tier is why the instrument is what people learn on.

The relevant caution belongs with the tool rather than the company, and the interception article on this site makes it: an intercepting proxy is technically identical whether the person running it was authorised or not. What separates a test from an intrusion is a scope document and a signature, which is why the professional discipline around this product is procedural rather than technical.

Fontes