IntermediateTools

Burp Suite Introduction: Web Application Security Testing

Learn how to use Burp Suite for web application security testing including proxy configuration, core tools, and testing workflows.

#Burp Suite#Web Security#Penetration Testing#Proxy#Web Application

Why You Need Burp Suite

You need to test a web application's security — Burp Suite is the professional standard for intercepting, inspecting, and manipulating HTTP/HTTPS traffic. Its proxy captures every request between your browser and the target, while Repeater, Intruder, and Scanner let you probe for vulnerabilities methodically.

Installation and Setup

Download from portswigger.net. Java Runtime Environment (JRE) 17+ is required. Run with java -jar burpsuite_community.jar.

Community Edition is free with essential tools. Professional Edition ($449/year) includes the automated vulnerability scanner.

Configuring the Proxy

Step 1: Proxy Listener

By default, Burp listens on 127.0.0.1:8080. Verify in Proxy > Options > Proxy Listeners.

Step 2: Configure Browser

Configure your browser to use 127.0.0.1:8080 as HTTP/HTTPS proxy. Use FoxyProxy extension in Chrome/Firefox for easy switching.

Step 3: Install CA Certificate

Browse to http://burpsuite and download the CA certificate. Import it into your browser's trusted certificate authorities to intercept HTTPS traffic.

Core Tools

Proxy

Intercepts HTTP/HTTPS requests between browser and server. Toggle interception on/off, forward or drop requests, and send interesting requests to other tools.

HTTP History shows all requests made through the proxy with details about parameters, headers, and responses.

{@visual burp-proxy-request}

Repeater

Allows manual modification and resending of HTTP requests. Right-click any request, send to Repeater, modify parameters or headers, and click Send to see the response.

Use cases: Testing parameter handling, exploring API endpoints, testing authentication bypass, and manipulating request data.

Intruder

Performs automated attacks by sending many requests with different payloads. Define insertion positions, payload sets (wordlists, numbers, characters), and attack types (Sniper, Battering Ram, Pitchfork, Cluster Bomb).

Use cases: Brute force login forms, fuzzing for hidden parameters, enumerating user IDs, and testing parameter validation.

Decoder

Handles data encoding and decoding including URL, Base64, HTML, hex, and hash generation. Smart decode auto-detects encoding types.

Practical Testing Workflow

1. Map: Browse the application with proxy recording, review the sitemap, and identify all endpoints.

2. Analyze: Examine requests in HTTP History for interesting parameters, cookies, and headers.

3. Test Manually: Use Repeater to test for SQL injection, XSS, IDOR, and authentication bypass.

4. Report: Document vulnerabilities with proof of concept and remediation recommendations.

Useful Extensions

Burp's BApp Store offers extensions including Autorize (authorization testing), JSON Web Tokens (JWT manipulation), Turbo Intruder (high-speed brute forcing), and Active Scan++ (enhanced scanning rules).

Best Practices

Configure proxy correctly, use scope settings to focus on target domains, save project state with project files, document findings, and learn keyboard shortcuts to speed up workflow.

Burp Suite is an essential tool for web application security. Start with the Community Edition to learn fundamentals before considering Professional for automated scanning capabilities.

References

{@ref burpsuite-docs}

{@ref owasp-testing-guide}

{@ref owasp-top10}

Frequently Asked Questions

What is Burp Suite used for?

Burp Suite is a web application security testing platform used to intercept, inspect, and modify HTTP/HTTPS traffic. It helps testers find vulnerabilities like [SQL injection](/learn/sql-injection-basics), [XSS](/learn/xss-basics), authentication bypass, and IDOR by manipulating requests between the browser and server.

What is the difference between Burp Suite Community and Professional?

Community Edition is free with manual testing tools (Proxy, Repeater, Intruder, Decoder). Professional ($449/year) adds the automated vulnerability scanner, advanced attack tools, and project saving. Community Edition is sufficient for learning and manual testing.

How do I configure my browser to use Burp Suite?

Set your browser proxy to 127.0.0.1:8080. Use the FoxyProxy extension for easy switching. Then browse to http://burpsuite to download and install the CA certificate, which allows Burp to intercept HTTPS traffic without certificate errors.

What is the difference between Repeater and Intruder?

Repeater lets you manually modify and resend individual requests to test server responses. Intruder automates attacks by sending many requests with different payloads (brute force, fuzzing). Use Repeater for targeted manual testing and Intruder for automated parameter testing.

How do I test for SQL injection with Burp Suite?

Intercept a request with parameters in the Proxy, send it to Repeater, and inject SQL payloads into parameter values. Look for error messages, different response content, or time delays. For automated testing, use Intruder with SQL injection wordlists or the Professional scanner.

What are Burp Suite extensions and which should I install?

Extensions add functionality from the BApp Store. Essential extensions include Autorize (authorization testing), JWT Editor (token manipulation), Turbo Intruder (high-speed attacks), and Active Scan++. Install extensions based on your testing needs through the Extender tab.

How do I use Burp Suite to test API endpoints?

Use the Proxy to capture API requests from your browser or API client. Send requests to Repeater to modify parameters, headers, and body data. Test for injection, broken access control, and mass assignment. Use Intruder to fuzz API parameters with different values.

What is the best way to learn Burp Suite?

Practice on PortSwigger Web Security Academy (free labs by Burp's creators), then try DVWA and HackTheBox web challenges. Start with Proxy and Repeater, then advance to Intruder and extensions. Our [web security fundamentals](/learn/web-security-fundamentals) guide provides background on vulnerabilities to test for.

Can Burp Suite test mobile applications?

Yes. Configure your mobile device to use Burp's proxy (install the CA certificate on the device), or use Burp's built-in mobile tools. For Android, you can also use Burp with rooted devices or the BURP Suite Mobile Assistant app for non-rooted devices.

How do I save my Burp Suite testing progress?

Community Edition does not support project saving. Professional Edition saves project state including history, sitemap, and scanner results. For Community, manually document findings, export HTTP history, and save important requests. Use the Logger tab to review traffic.