Burp Suite
Tied for most recommended of 5 pentest tools
Widely used web security testing proxy; people value its familiar workflows, strong interception, and a Community Edition that works well. Critics note the setup is heavy and the UI opinionated.
Widely used web security testing proxy; people value its familiar workflows, strong interception, and a Community Edition that works well. Critics note the setup is heavy and the UI opinionated.
10 people gave an opinion
- recommend it
- 9
- criticize it
- 1
- approval share
- 90%
Recommended in 6 of 13 months
- November 2025: recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: not recommended
- March 2026: not recommended
- April 2026: recommended
- May 2026: not recommended
- June 2026: recommended
- July 2026: not recommended
- August 2026: not recommended
- September 2026: not recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 9 people recommend itNeeds 10 or more, not met.
- 9 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 6 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Widely used, familiar workflows
“I mostly stick with Burp because I'm very familiar with its workflows and tooling”
Comment from 20 Dec 2025 in “Charles Proxy” “makes the most widely used pentesting suite in the world”
Comment from 1 Oct 2026 in “Ask HN: Who is hiring? (October 2026)”
What people warn about
Each mark is one comment
More setup and opinionated UI
“That power comes with more setup and a more opinionated UI.”
Comment from 20 Dec 2025 in “Charles Proxy” Weak automation features and UX
“All are great, but I've never been completely satisfied with the UX/features for building automations.”
Comment from 16 Apr 2026 in “Launch HN: Kampala (YC W26) – Reverse-Engineer Apps into APIs” Gemini CLI fails due to HTTP2
“the Gemini chat responses fail in the CLI, which I understand is due to how Burp handles HTTP2”
Comment from 28 Jan 2026 in “A MitM proxy to see what your LLM tools are sending”
Other pentest tools people recommend
The four most recommended other pentest tools, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| Burp SuiteThis page | 9 | 1 | 90% | 6 | — | — |
| Strix | 9 | 6 | 60% | 4 | — | — |
| Deadend CLI | 6 | 0 | 100% | 1 | — | — |
| SmokedMeat | 6 | 0 | 100% | 1 | — | — |
| ZAP (Zed Attack Proxy) | 5 | 1 | 83% | 5 | — | — |
What people said
10 of the 11 comments that mention it, newest first. Each links to the original comment.
“makes the most widely used pentesting suite in the world”
“ZAP, Burp, Nessus, SQLMap, etc. are likely also impressive if you put a little effort into learning how to use them”
“All are great, but I've never been completely satisfied with the UX/features for building automations.”
“the Gemini chat responses fail in the CLI, which I understand is due to how Burp handles HTTP2”
“Burp is enough. Even the Community Edition works great.”
“Burp Suite uses a subscription model.”
“I mostly stick with Burp because I'm very familiar with its workflows and tooling”
“I like Burp Suite better for intercept”
“That power comes with more setup and a more opinionated UI.”
“I, for example, would have never gotten into tech were it not for the freely available learning resources and software graciously provided by the open source community.”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.