Burp Suite

Burp Suite is a comprehensive web application security testing platform used for intercepting HTTP/HTTPS traffic, scanning for vulnerabilities, performing automated attacks with Intruder, and manually testing requests with Repeater. It is the industry standard for web application penetration testing.

Burp Suite Community Edition is free with limited features including manual tools like Repeater and Intruder (with throttling). The Professional edition ($449/year) adds automated vulnerability scanning, Collaborator, advanced scanning filters, and unlimited Intruder attack speed.

Both are web application security testing proxies. Burp Suite has a more polished interface and larger extension ecosystem, while OWASP ZAP is completely free and open source with strong automation capabilities. Choose Burp for professional penetration testing and ZAP for cost-sensitive projects or CI/CD integration.

Yes, Burp Suite supports API security testing including REST, GraphQL, WebSocket, and gRPC endpoints. The Professional edition includes dedicated API scanning capabilities, and extensions like OpenAPI Parser can automatically generate attack surfaces from API specifications.

Burp Collaborator is a service that provides unique out-of-band callback URLs for detecting blind vulnerabilities. When testing for blind SSRF, blind XSS, or out-of-band SQL injection, Collaborator records incoming DNS and HTTP requests, confirming whether your payload triggered a server-side interaction.

Navigate to http://burpsuite in your browser while the proxy is running. Download the CA certificate from the provided link, then import it into your browser's certificate authority store. For Firefox, use Preferences > Certificates > Authorities > Import. For Chrome, use Settings > Privacy and Security > Manage Certificates.

Intruder offers four attack types: Sniper (tests one position at a time), Battering Ram (sends the same payload to all positions), Pitchfork (iterates multiple payload sets in parallel), and Cluster Bomb (tests all combinations of multiple payload sets). Choose based on whether you are testing single or multiple parameters.

Yes, Burp Suite can test mobile apps by configuring the device proxy to point at Burp's listener. Install the CA certificate on the device to intercept HTTPS traffic. For Android, you may need to bypass certificate pinning using tools like Frida or JustTrustMe.

Burp Proxy intercepts and displays HTTP/HTTPS traffic in real-time for manual inspection. Burp Scanner automatically crawls the application and tests for vulnerabilities like SQL injection, XSS, and CSRF. Proxy is manual; Scanner is automated. Both require the Professional edition for full functionality.

Burp Suite's built-in browser (in Professional) renders JavaScript applications natively, enabling testing of SPAs and AJAX-heavy sites. The Spider can execute JavaScript to map dynamic content, and manual testing through the proxy captures all XHR and fetch requests made by the application.

Yes, Burp Intruder supports brute-force and dictionary attacks against login forms. Configure payload positions on the username and password parameters, select appropriate payload lists, and use the Sniper or Cluster Bomb attack type. The Professional edition's Turbo Intruder extension offers significantly faster attack speeds.

Essential extensions include Logger++ for enhanced request logging, Autorize for testing access control, Turbo Intruder for high-speed attacks, Collaborator Everywhere for injecting Collaborator payloads, Param Miner for hidden parameter discovery, and InQL for GraphQL introspection testing.

Go to Project > Save and choose a location for the .burp project file. The project stores all proxy history, scan results, and configuration. Reload with Project > Open when starting a new session. Use temporary projects for quick tests and named projects for long-term engagements.

Burp Suite Enterprise Edition is designed for CI/CD integration with REST APIs for triggering scans and retrieving results. The Professional edition can be scripted using the Montoya API. Community Edition has limited automation capabilities.

Send the target request to Repeater (right-click > Send to Repeater). Modify parameters with SQL injection payloads like ' OR 1=1--, ' UNION SELECT null--, and watch for error messages or different responses. Use Intruder for automated payload testing across multiple positions. The Scanner (Professional) automatically detects SQL injection vulnerabilities.

Yes, use Repeater to manually inject XSS payloads like <script>alert(1)</script> into parameters and check if they execute in the response. Use Intruder with a list of XSS payloads for automated testing. The Scanner (Professional) detects reflected, stored, and DOM-based XSS. Extensions like XSS Validator automate XSS detection and confirmation.

Community Edition includes Proxy, Repeater, Intruder (throttled), Decoder, Comparer, and Sequencer. It lacks automated scanning, Collaborator, Turbo Intruder, session handling rules, and project saving. Intruder attacks are rate-limited to prevent automated use. For professional penetration testing, the Professional edition is recommended.

While both are proxies, you can chain them: configure your browser to use Burp as proxy, then configure Burp's upstream proxy to point at ZAP. This allows Burp for manual testing and ZAP for automated scanning simultaneously. However, most professionals use one or the other rather than chaining, as each has its own workflow.

Burp Suite alone cannot bypass certificate pinning. Use the Bypass WSA extension or mobile-specific tools like Frida with ssl-unpinning scripts. For Android, install Burp's CA certificate as a system certificate (requires root). For iOS, use a jailbroken device or configuration profile. Certificate pinning is specifically designed to prevent MITM interception.

Go to Sequencer > Live Capture and configure the target URL that sets session tokens. Sequencer captures multiple session tokens, analyzes their entropy, and generates statistical reports showing randomness quality. Poor session token entropy indicates predictable tokens that attackers could guess or brute-force for session hijacking.

Generate a unique Collaborator payload with Burp Collaborator client. Inject the payload into target parameters (e.g., blind SSRF: http://COLLABORATOR_PAYLOAD/ping). Collaborator records incoming DNS and HTTP requests, confirming server-side interactions. Use the Collaborator Everywhere extension to automatically inject payloads into all requests for comprehensive blind vulnerability scanning.

Yes, Burp Suite supports WebSocket testing through the Proxy, Repeater, and Intruder tools. WebSocket connections appear in the Proxy history. Send WebSocket messages to Repeater for manual manipulation, or use Intruder for automated payload injection. The WebSocket message frames can be modified in real-time, making Burp effective for testing chat applications, live feeds, and API gateways.

Configure your mobile device to use Burp's proxy (your Kali IP:8080). Install Burp's CA certificate on the device. For Android 7+, use network_security_config.xml to trust user certificates, or root the device and install the CA as a system certificate. Use Burp's Logger to monitor all mobile app traffic and identify API endpoints for further testing.

Turbo Intruder is a high-speed attack extension for Burp Suite Professional that uses Python scripts for custom attack logic. Use it when the built-in Intruder is too slow for your target. Turbo Intruder achieves 10-100x faster request rates by optimizing HTTP connection handling. Ideal for race condition testing, large-scale parameter fuzzing, and high-volume credential stuffing.

Intercept JWT tokens in Proxy history and decode them with Decoder (Base64). Test for common JWT vulnerabilities: algorithm confusion (RS256→HS256), missing signature verification, and weak signing keys. Use the JSON Web Tokens extension to automate JWT attacks. Try none algorithm bypass, key brute-forcing with hashcat, and token forgery to demonstrate broken authentication.