Burp Suite CLI

burp-suite-pro-cli --config <yml>

Run Burp Suite scan from CLI with YAML config, the commercial DAST automated in the pipeline.

Run it in the CI/CD pipeline when you want commercial DAST: burp-suite-pro-cli (Enterprise or Pro CLI) runs the scan against the URL with the YAML config (scope, crawl, active scan, login) and reports findings with severity. It's the commercial reference DAST: deep scan (crawl with login, active scan with BApp extensions) automated. In DevSecOps, Burp is the pipeline choice when open-source DAST (ZAP) falls short: scanning with authenticated session and full coverage.

Don't use it without the license: Burp CLI requires Pro/Enterprise (commercial license) — cost is the requirement; ZAP covers the open-source ground. Active scan generates real traffic: the test environment is the site. And watch out: the config (YAML: scope, login) defines coverage — without authenticated session, the scan doesn't see protected routes; false positives are triaged. Commercial DAST complements SAST: the app at runtime with deep pipeline scan.