The key questions I would pose are: how high of a concurrent load do you need to generate against the system? How technically skilled are your personnel that will perform the load testing? How much programmable/scripting/code based control do you desire from the tool? Do you prefer more of a GUI based tool or a programmatic code/scripting based tool? JMeter will be for those that want a GUI, moderate to low scripting/code based control/programmability, moderate to low load generation, and for users experienced in the novice to expert range.
It's great for intercepting and changing login request. For one client i had done testing of their website, and after intercepting and changing the request, I got IDOR vulnerability and it's a very high vulnerability i gave it in the report, and with the BAPP store, I downloaded the IIS TILDE enumeration and got a vulnerability.
Easy to construct Webservices script - You just need to add a sampler with the endpoint, payload and header information. And boom you can run a load test on the service with varying load and capture the response time and throughput. In a commercial tool like Loadrunner or Silkperformer, this process would take at least couple of hours, while with Jmeter we can do this in 10 minutes or less.
Modularizing the scripts - Jmeter has a very good way of organizing the scripts and the reusability of the existing script (transactions) is also as easy as copy pasting the script.
Jmeter tests can be run from anywhere, so you can run it from the idle webserver itself if you have some firewall restrictions to test it from your local or other environment.
Jmeter distributed tests can be spawn from the AWS and results collated to see the performance from different regions in the world.
Even though it has very easy installation, you can run into issues easily. I was ab;e to trigger a test at browser level but couldn't stop the tests. I had to kill it from task manager and then had to reinstall from begining.
There are so many things in JMeter you can do especially with the sampler for selenium for UI tests. More documentation/webinars etc.. would help the community better.
The jmx files should have an easy way to be integrated with ci/cd tools and cloud.
The interface is a big problem: No matter how many features a software provides you, if the features are not well presented, you will miss most of them when they are actually required. The presentation of the software should be improvised and made more presentable.
Tutorial videos for beginners: This software lacks a lot in tutorials. A beginner almost wastes most of the time in finding and understanding the features and the implementation of the same. The software vendor should work on providing more in-depth videos so that people can learn and understand the concepts.
Price, Wiki and user sharing. Having access to the information provided by the developers and other open source providers is key for me. The ability to share information and get answers directly is very important to success in software testing. And the price of this product currently is amazing. Too many companies charge way too much money for products that are far behind in their value and pertinence
I can jump right into a new test plan and start building from scratch. The natural progression from test plan to thread group and then designing the basic format of the process is very streamlined and smooth. With only slight modifications I can build out a very complex model from a very basic beginning.
Easy to use once you learn it; however, the user interface is not very intuitive at first view. Port Swigger does provide a lot of video resources for self-paced learning which helps. Most of the end users for PortSwigger Burp Suite will be technical and should be able to learn the product with the free resources.
I have been using JMeter for the last year. By using this tool, you can make sure the system will work under varied loads. It helps us to simulate real time scenarios by creating required virtual users and make sure the application will work under load. Perform load, stress, and stability testing using JMeter.
BurpSuite does not have an amazing customer support. All the major help that you will find is from public forums and Google. Although you will find all the required information on Google, still at time professional support helps you solve the problem in much less time and make your operations go smoothly.
I have evaluated LOADUI (web free version) and it was a very unstable tool and I could not rely on those results completely as I was not sure how the tool was performing. It only generated the top 10 less transaction times and when Jmeter was in use, it was very effective in using plugins to accommodate more outputs.
Burp Suite stacks up fairly well against these other two products both of which are quite expensive to license. The best other product I would suggest is OWASP Zed Attack Proxy or ZAP. It performs quite well and the cost of the product is free. ZAP is an Open Source product. If, however, you do not want to use an open source product I would either go with Burp Suite or look into the more expensive Rapid7 AppSpider.
It helped to estimate resources required for a particular client requirement. For example if the client wants the application to be used by 500 users for 1 hour, based on the load test we perform for 500 users and 1 hour we recommend resources and their capabilities.
Jmeter was used to identify bottleneck. This would lead to better performance.
