Top 10 Pentesting Tools and Extensions in Burp Suite - Port Swigger

Summary: PortSwigger published a list of its top 10 Burp Suite extensions, selected by BApp store download popularity, PortSwigger Research team input, and user community feedback, updated December 2019. The extensions include Logger++, Autorize, Turbo Intruder (capable of tens of thousands of HTTP requests per second), J2EEScan (over 40 J2EE-specific vulnerabilities), Backslash Powered Scanner, Upload Scanner, Retire.js, JSON Beautifier, AuthMatrix, and Param Miner (up to 65,000 parameter names per request).
What you should know: Burp Suite Professional is cited as having more than 55,000 users across over 150 countries, and the extensions here are ranked by BApp store downloads - so the tooling your testers reach for is shaped by what the wider community has already adopted.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026