Burp Suite

What is it?

Burp Suite is an intercepting proxy. It sits between your browser and the target web application. Every request your browser sends goes through Burp first, you can see it, modify it, replay it, or automate attacks against it.

The core components you'll use constantly:

• Proxy: intercepts browser traffic so you can inspect and modify requests before they reach the server
• Repeater: resend individual requests with modifications. This is where you manually test for SQLi, XSS, IDOR, and every other web vulnerability
• Intruder: automated attacks using wordlists. Brute-force login forms, enumerate users, fuzz parameters
• Decoder: encode/decode Base64, URL encoding, HTML entities, hex, etc.
• Comparer: diff two responses to spot subtle differences (critical for blind injection testing)

Burp is your primary workspace for web testing. Where Gobuster finds the pages, ffuf fuzzes the parameters, and sqlmap automates the exploitation, Burp is where you understand the application's behavior and identify the vulnerability in the first place.

Set this up first

Nothing works until your browser sends its traffic through Burp. Do these three steps once.

1. Start Burp and keep the Proxy listener on its default address, 127.0.0.1:8080.
2. Point the browser at that listener, for example with a proxy switcher such as FoxyProxy.
3. Install Burp's CA certificate in the browser, so HTTPS sites load without errors.

Then turn Intercept off while you browse, set the target scope so Proxy history stays clean, and send interesting requests to Repeater.

When do you use it?

Every time there's a web application. Any port running HTTP/HTTPS, port 80, 443, 8080, 8443, or any other web service, goes through Burp. Start Burp before you even open the browser.

• Understanding the application: browse the site with Burp capturing traffic, then review the sitemap to understand the application's structure
• Testing authentication: intercept login requests, test for SQLi, default credentials, rate limiting
• Finding injection points: add ' to every parameter in Repeater, watch for errors
• Testing authorization: capture a request as one user, change the session cookie to another user's, check if the action still works (IDOR)
• File upload testing: modify Content-Type, filename, and file content to bypass upload restrictions
• Saving requests for sqlmap: right-click → "Copy to file" → pass to sqlmap with -r

Proxy setup

Burp listens on 127.0.0.1:8080 by default. You need to configure your browser to send traffic through it.

Browser configuration

# Option 1: FoxyProxy extension (recommended)
1. Install FoxyProxy Standard from Firefox Add-ons
2. Click FoxyProxy icon → Options
3. Add new proxy:
   - Title: Burp
   - Type: HTTP
   - IP: 127.0.0.1
   - Port: 8080
4. Click FoxyProxy icon → select "Burp" to route traffic through Burp
5. Click "Turn Off" to stop proxying

# Option 2: Manual browser settings
Firefox → Settings → Network Settings → Manual proxy config
HTTP Proxy: 127.0.0.1   Port: 8080
Check "Also use this proxy for HTTPS"

CA certificate installation

Without Burp's CA certificate, HTTPS sites show certificate errors because Burp is performing a man-in-the-middle on your own traffic.

1. With proxy active, browse to: http://burp
2. Click "CA Certificate" to download
3. Firefox → Settings → Privacy & Security → Certificates → View Certificates
4. Import → select the downloaded cacert.der
5. Check "Trust this CA to identify websites" → OK

# Now HTTPS sites work through Burp without certificate warnings

Intercepting and modifying requests

The Proxy tab's "Intercept" feature pauses every request so you can modify it before it reaches the server.

# 1. Turn on Intercept: Proxy → Intercept → "Intercept is on"
# 2. Submit the login form in browser
# 3. Burp catches the request:

POST /login HTTP/1.1
Host: 10.10.10.10
Content-Type: application/x-www-form-urlencoded

username=admin&password=test123

# 4. Modify the request before forwarding:
#    - Change password to: admin' OR 1=1--
#    - Click "Forward" to send the modified request
# 5. Check if you're logged in → SQL injection works!

# Pro tip: Right-click → "Send to Repeater" for more controlled testing

Repeater workflow

Repeater is where you spend 80% of your Burp time. It lets you modify a request, send it, see the response, and repeat, all in one pane.

# 1. From Proxy History, find the interesting request
# 2. Right-click → "Send to Repeater" (Ctrl+R)
# 3. In Repeater, modify the parameter and click "Send":

# Test 1: Normal request (baseline)
GET /search?id=1 HTTP/1.1
#   → Response: 200 OK, shows product

# Test 2: Single quote
GET /search?id=1' HTTP/1.1
#   → Response: 500 Error, SQL syntax error → INJECTABLE!

# Test 3: Boolean true
GET /search?id=1 AND 1=1-- HTTP/1.1
#   → Response: same as Test 1

# Test 4: Boolean false
GET /search?id=1 AND 1=2-- HTTP/1.1
#   → Response: different (empty/error) → CONFIRMED boolean blind SQLi

# 4. Right-click → "Copy to file" → save as request.txt
# 5. Run: sqlmap -r request.txt -p id --batch --dbs

Intruder attack types

Intruder automates attacks with wordlists. Right-click a request → "Send to Intruder", then highlight the attack positions (where payloads get inserted).

Example: brute-forcing a login

# 1. Send login request to Intruder
# 2. Highlight the positions to attack:
POST /login HTTP/1.1
Host: 10.10.10.10

username=§admin§&password=§password§

# 3. Choose attack type:
#    - Sniper: test passwords for one known username
#    - Cluster Bomb: try all usernames with all passwords

# 4. Payloads tab:
#    Position 1 (username): admin, administrator, root, user
#    Position 2 (password): load from /usr/share/seclists/Passwords/...

# 5. Click "Start Attack"
# 6. Sort results by Status code or Length, successful login has different response

Decoder

Quick encoding/decoding of values you encounter during testing. Essential for understanding cookies, tokens, and encoded parameters.

# Base64 cookie:
eyJ1c2VyIjoiYWRtaW4iLCJyb2xlIjoiYWRtaW4ifQ==
# Decode as Base64 → {"user":"admin","role":"admin"}
# Change to {"user":"admin","role":"superadmin"}, re-encode, send in Repeater

# URL-encoded parameter:
search=%27%20OR%201%3D1--
# Decode URL → ' OR 1=1--

# JWT token (Base64url):
eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJ1c2VyIjoiYWRtaW4ifQ.
# Decode each part separated by dots to inspect claims and algorithm

Community vs Pro

Tips and shortcuts

Common mistakes

Related tools

Check yourself

Answer each question out loud or on paper first, then open it. Retrieving the answer teaches you more than rereading the page.