Also, if I'm justifying Burp to a non-security person, part of the reason why is that Intruder would allow me to do all sorts of wacky integration and stress tests without having to write fiddley code. A rule-based request generator is a pretty useful tool for the box.
$299/year seems pretty affordable, I was expecting to see something that cost thousands from the way you were talking. I know zilch about Appsec, but this appeals to the part of me that's good at breaking things.
You could use it to benchmark (it might be useful for that in cases where what you were benchmarking wasn't raw request handling speed, or the performance of simple SQL queries, but rather some backend event that would only be tickled by a particular pattern of requests), but the real thing it does that I think ab doesn't do is collect all the responses and allow you to compare them.
(It's actually not great at doing those comparisons, but I don't have a better alternative).
Burp costs money, but it costs so little money relative to its value that if you think it's expensive, I'm going to suggest you're doing something wrong with your bill rate.
> Burp costs money, but it costs so little money relative to its value that if you think it's expensive, I'm going to suggest you're doing something wrong with your bill rate.
Couldn't agree enough. Even if this is something you do as a hobby, Burp will more than pay for itself in a single bug bounty payout.
