Apache JMeter vs. PortSwigger Burp Suite vs. ReadyAPI

JMeter is well suited for Java applications where the user can script the scenario once and make changes to accommodate for as many numbers of users for load test execution. The image and selection of any files or exporting files scenario is handled well.

It is less appropriate to test Ajax applications where it is required to script click per use.

Incentivized

Burp Suite is a good general tool to test websites as long as your website is not too large or you have the time for it to complete. We have some websites that only about five to ten minutes for Burp Suite to complete an attack and a spider only takes about two minutes. Other websites have taken a few hours to complete. I have seen a tester actually run Burp Suite against one of our websites and it took all day to complete.

Incentivized

As stated, we do a LOT of API testing, the swaggerhub import makes it easy to add APIs. This is very well-suited, as well as easy management of the steps/cases/suites inside of ReadyAPI. The one thing I do wish ReadyAPI was better suited for is changes to data, we have a lot of test cases in ReadyAPI and if we make a change to how the backend data is structured, one-by-one adjustments need to be made to the steps. Less appropriate, UI testing.

Incentivized

• Easy of use - in generate load like HTTP requests, and processing/analyzing the responses. No coding is necessary at the basic level, just need to understand load testing and the infrastructure being tested.
• Automatic management of things like cookies to help with session state support - so you don't specifically have to worry about it or handle it
• Lots of testing/configuration options to suit your needs in making the right load generation (sampling requests), and analyzing the results, including any pre and post processing of the results first. Things like the Beanshell/BSF pre/post processors, response assertion, regular expression extractor, XPath extractor, CSV data set config
• There is a JMeter cloud service called BlazeMeter that I think would be useful for those that need to scale up high load without provisioning their own systems. I've not personally tried it though, but I recently attended a meetup presentation that highlighted nice useful features that BlazeMeter provides. One should evaluate the service if they are considering JMeter and need to expand beyond existing hardware resources.

• The passive scan feature is really awesome, it kind of covers areas that you might miss.
• The CSRF POC is really helpful to my team. It helps development team see the issue and understand it.
• Burp intruder and repeater are the features I myself and my team uses the most as it helps us use our payloads in a variety of different ways.
• Active scan helps the team to ensure coverage for the whole application.

• Ease of use (ability to automatically import API definitions, Jenkins integration for running in the pipeline).
• Detailed test reports (allow to easily identify weak spots during both functional and performance testing).
• One platform for all tests (allows to closely couple and reuse existent tests).

Incentivized

• Jmeter requires many tweaks with respect to its configuration file and thread properties. users need to edit theses files themselves. There could be some interface where we can edit this fields.
• Jmeter cannot handle more threads and hangs up when we increase the number of threads. This causes lot of inconvenience. In these situations, user can be notified that such change would be lead to slow performance so that user can do as required. The same appears when we try to view huge files on graph listener.
• Jmeter should optimize the read and write access to output csv since it acts as overhead to the I/O performance. This affects our test results for the application which we are testing.

• The interface is a big problem: No matter how many features a software provides you, if the features are not well presented, you will miss most of them when they are actually required. The presentation of the software should be improvised and made more presentable.
• Tutorial videos for beginners: This software lacks a lot in tutorials. A beginner almost wastes most of the time in finding and understanding the features and the implementation of the same. The software vendor should work on providing more in-depth videos so that people can learn and understand the concepts.

Incentivized

• Needs good documentation
• Need to improve the performance of the tool
• Setup is very complex and for such [a] commercial tool, it should easy and straightforward
• Tool says it supports security testing but in reality, it is not at an extensive level.

Incentivized

Price, Wiki and user sharing. Having access to the information provided by the developers and other open source providers is key for me. The ability to share information and get answers directly is very important to success in software testing. And the price of this product currently is amazing. Too many companies charge way too much money for products that are far behind in their value and pertinence

The only reason this isn't a '10' is because of the cost. This product is definitely meant for organizations who are serious about making sure they invest in the full ecosystem of API design, development, maintenance. But there is a significant cost associated with this investment. and because of this cost (and the non-tangible output for executives), it is a difficult line-item to justify in this post-pandemic environment.

Incentivized

The purpose related to performance and load testing through Apache JMeter works fine but the usability of the tool should be improved quite a lot. If someone starts with the Jmeter fresh without prior experience, they need to put more efforts in understanding the tool. The UI is not that great which is the main reason not to give high rating on usability.

Incentivized

The workflow between features like Proxy, Scanner, Intruder, and Repeater feels seamless, making it easy to intercept, manipulate, and analyze web traffic. Despite its advanced capabilities, the tool remains accessible and flexible, which significantly speeds up testing without overwhelming the user.

Incentivized

SoapUI allows us to combine multiple tests and adhere
to the sequence that they need to run in order to complete successfully.
It has an excellent GUI design and the reporting mechanism is also very
good. It does consume a lot of memory though during concurrent testing

Soap UI has managed to continuously build on it's solid foundation and keep improving by each release. It is by far the most dependable and accurate testing tool out there of its kind. Available via connecting to VM's created as SoapUI test machines give access to it anytime, anywhere practically.

It has an excellent GUI design and the reporting mechanism is also very
good. It does consume a lot of memory though during concurrent testing.

I have been using JMeter for the last year. By using this tool, you can make sure the system will work under varied loads. It helps us to simulate real time scenarios by creating required virtual users and make sure the application will work under load. Perform load, stress, and stability testing using JMeter.

Incentivized

BurpSuite does not have an amazing customer support. All the major help that you will find is from public forums and Google. Although you will find all the required information on Google, still at time professional support helps you solve the problem in much less time and make your operations go smoothly.

Incentivized

To be honest, we didnt had much issues with the support, as there is already plenty of online communities available for help. But if ever there were some minor issues with the membership or the certificates, the tech support was always quick and efficient enough to resolve the issue ASAP

Incentivized

no very easy but lacks documentation

I have used LoadRunner and Silkperformer, and so far Jmeter turns out be the easiest to use of all these. While each of them have their own ROI, Jmeter can be picked by anyone in hours and start testing within a day. While with other tools, we need to get license, install them (takes a while) and setup tests and firewalls, etc.

Each tool is specific and are good for what they do. While Burp Suite can perform some level of the same functions, somehow security consultants prefer these tools as additional to the Burp Suite. Maybe due to open source and easy setup when compared to Burp Suite. But Burp Suite allows for one tool for many templates for each project.

Incentivized

ReadyAPI provides intuitive GUI capabilities compared to their own open source product. When compared to Postman, ReadyAPI also supports SOAP based services, which is a saver especially when integrating with legacy or other third party systems.

Incentivized

It has an excellent GUI design and the reporting mechanism is also very
good. It does consume a lot of memory though during concurrent testing. However, I have read that added monitoring tools have been added, which if so the 7 could possibly go to a 8 or 9.

• Good ROI on improving the performance of the application.
• Finding issues in the performance.
• Benchmark the performance results.
• CON: Need skillset to create and maintain the scripts in Java.
• Scripts are reusable and it is executed by any user.
• Need Client and Server setup to execute the scripts.

Incentivized

• Scanned 100% of the orgs public facing web sites with a small team of analysts.
• Provided a reputable second opinion source to back up the other product in use i.e. Webinspect.
• Pro version $350 is amazing ROI, considering the thwarted attacks and that it's competition is priced in the tens of thousands last I checked.
• No successful hacks. Q.E.D. :-)

Incentivized

• Very quick regression testing, hence having the testing results very soon, even the same day of deployment
• for same above reason, it can save money for corporation (so no tedious, costly and erroneous manual testings)
• The test reports are compatible with TestNG, so the corporation can integrate the reports in our Autamation frameworks such as Allure or Jira Zephyr

Incentivized