Burp Suite DAST

7.1easy start · #5 of 35
in Penetration Testing Software

Free to practise onnot on record
Free trialyes
Well documentedyes
Runs where you workyes

Runs on api, Linux, self-hosted, Web, Windows.

Burp Suite DAST is ranked #5 of 35 in penetration testing software on The Geeks Club. It runs on API, Linux, Self-hosted, Web, Windows. A free trial is offered.

Burp Suite DAST plans and pricing

All plans

Burp Suite DAST Not published Tailored solution; pricing depends on portfolio; contact PortSwigger portswigger.net · 4 Oct 2026

Compared on penetration testing software

Authenticated scanning: Yes
API testing: Yes
Browser-based scanning: Yes
CI/CD integration: Yes
Deployment model: hybrid

Best Burp Suite DAST alternatives

See all 20

Dradis 0 of 4 in the starter kit Lesson 18.0 Pentesterra 0 of 4 in the starter kit Lesson 27.5 RedAmon 0 of 4 in the starter kit Lesson 37.3 Caido 0 of 4 in the starter kit Lesson 47.2 Faraday 0 of 4 in the starter kit Lesson 67.1 PenTest.WS 0 of 4 in the starter kit Lesson 77.1

The record

Purpose: Burp Suite DAST is an automated dynamic web vulnerability scanner built on the scanning engine used in Burp Suite Professional.
Modern web scanning: Its Chromium-based crawler handles JavaScript single-page apps, dynamic forms, GraphQL endpoints, and asynchronous loads, with parallel crawl and audit.
API coverage: It scans APIs defined by Postman Collections, OpenAPI, SOAP, and GraphQL, with native Basic, Bearer Token, API Key, and OAuth 2.0 Client Credentials authentication.
Custom checks: BChecks authored for Burp Suite Professional run unchanged in Burp Suite DAST.
Access controls: The product supports role-based access control, site groups, audit trails, SAML single sign-on, and scan policy templates that can be locked per group.
Deployment: Burp Suite DAST is available as managed cloud service or self-hosted software, including Windows and Linux installers and a Helm deployment for Kubernetes.
Air-gapped use: The self-hosted deployment supports air-gapped environments and can use PostgreSQL or Oracle for production.
Integrations: Named CI/CD integrations include Jenkins, GitHub Actions, GitLab CI, Azure DevOps, Bitbucket Pipelines, CircleCI, and TeamCity; findings can be delivered to Jira, ServiceNow, Azure Boards, and GitHub Issues.
API automation: A GraphQL API can trigger scans, fetch findings, manage sites, and send results to internal tools.
AI features: Optional Burp AI features include AI-enhanced issue investigation and AI-generated recorded logins; DAST administrators must enable the features for an instance.
AI data handling: The maker says AI request data is not stored by its AI providers and that Burp AI communications use TLS 1.2 or later; the AI documentation says the service is covered by PortSwigger’s ISO 27001 certification.
Support: The product page describes technical support from specialists, SLA-backed support for enterprise, onboarding, and a named solutions architect for the enterprise tier.
Pricing availability: The official pricing page displays a plans heading but no plan prices or limits in its readable page content; the product page directs buyers to request a demo or talk to sales.
API scanning: It scans APIs defined by Postman Collections, OpenAPI, SOAP, and GraphQL, with native Basic, Bearer Token, API Key, and OAuth 2.0 Client Credentials authentication.

Where it ranks on The Geeks Club

Best Penetration Testing Software in 2026#5 of 35
Best Web Application Security Scanners in 2026#7 of 31
Best Dynamic Application Security Testing Software in 2026#3 of 28

Is Burp Suite DAST yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote Burp Suite DAST

Sources

portswigger.net/burp/dast· checked 4 Oct 2026
portswigger.net/burp/documentation/dast/user-guide/usin· checked 4 Oct 2026
portswigger.net/burp/documentation/ai-features/trust· checked 4 Oct 2026
portswigger.net/burp/dast/pricing· checked 4 Oct 2026
portswigger.net/burp/documentation/dast/user-guide/refe· checked 4 Oct 2026
portswigger.net/burp/dast/trial· checked 4 Oct 2026
portswigger.net/about· checked 4 Oct 2026