Evaluating whether to start paying for a security tool is just an extension of the process of deciding whether to adopt it in the first place, except with more emphasis on relative impact.
Burp Suite Pro is undeniably a useful extension of the community version. You get the scanner, which integrates tightly with Burp's scoping and attack surface mapping features, and advanced manual tools, such as the ability to generate a CSRF from an intercepted HTTP request (which we'll cover later in this chapter), along with other goodies.
But as we showed in our chapter on CSRF, generating a CSRF PoC is pretty easy to automate yourself, in a way that better integrates with tools outside of Burp. If you don't find yourself needing the other advanced manual tools, then it basically comes down to the scanner. Even...
