What Community actually includes

PortSwigger's own Community Edition page is the source to read, and it is generous: the intercepting proxy, Repeater, Decoder, Sequencer, Comparer, and Intruder — the last described there as a demo. That is a real tool. For a student learning HTTP, or for manual testing of a simple app, it is genuinely enough.

The confusion starts because "free Burp" and "Burp" get used for two different products. Community and Professional share a shell and a feel, so a limit that exists in one reads as a bug in the other until you find the feature list.

The three limits that actually bite

  • No vulnerability scanner. The active and passive scanner is a Professional feature. This is the single biggest gap: on an engagement, the scanner is what turns "I looked at the app" into "I checked the app against a list."
  • Throttled Intruder. Intruder runs in Community, but as a demo — rate-limited so that anything beyond a small payload set becomes impractical. A brute force, a fuzzing run, or a race test wants thousands of requests, not hundreds.
  • No Collaborator. Out-of-band detection — the technique that confirms blind SSRF, blind RCE and blind injection when nothing shows in the response — is Professional-only. Without it, a whole class of bug is unconfirmable.

Professional adds these plus project files, the crawler and Search, for $499 per year per seat.

Why the limits are easy to miss

Because they are not error dialogs. The scanner tab is simply absent. Intruder accepts your payload set and then crawls through it. Collaborator never appears in a menu, so there is nothing to click and nothing to tell you what you are missing. The failure mode is not a message; it is quietly doing less testing than you think you are.

That is the honest case for reading the feature matrix once, early, rather than discovering the boundary mid-engagement when a client asks whether blind SSRF was tested.

The free paths around each limit

None of these gaps require money. They require a second tool, and the friction of a second tool is real — but so is the ceiling of working without one.

  • For the scanner: OWASP ZAP is free and open source and ships active and passive scanning. Its workflow is clunkier than Burp's, and it is a second app to learn, but the coverage is there.
  • For Intruder: any raw-HTTP fuzzer removes the throttle. The trade is that you lose Burp's UI on top of the payloads.
  • For Collaborator: a self-hosted out-of-band listener replaces it. You register a payload, watch an interaction, and confirm the blind bug — without a subscription.

The catch with the three-tool approach is exactly that it is three tools: three sets of certificates, three session states, three places to export from when you write the report.

One binary instead of three

This is the gap Hugin is built for, and it is worth being precise about what it does and does not replace.

Hugin's Community tier is free and includes the intercepting proxy, the active and passive scanner, Intruder at full speed, Repeater, Decoder and Sequencer. Crucially, the scanner and the un-throttled Intruder are in the free tier — they are not the paywalled demo. Hugin's proxy also speaks HTTP/3, which Burp's does not. It runs as one native binary with no account and no telemetry, which is also why there is no second and third tool to reconcile.

Where Burp is ahead, plainly: browser-powered DOM-XSS detection and a very large extension ecosystem. If your work is mostly client-side JavaScript, or you depend on a specific BApp, Burp Professional is the right buy and these pages say so. For server-side testing — injection, access control, smuggling, race conditions, blind bugs — the free tier of Hugin covers what Community throttles or omits.

What to do with this

If Community is covering your work, nothing below changes that. If you have hit the scanner's absence, the Intruder throttle, or the Collaborator wall, the fix is not necessarily a $499 licence. Try the free scanners and the self-hosted listener first; if maintaining three tools costs more time than the licence saves, that — not a feature count — is the argument for paying.