~ / blog / burp-suite-basics

Getting Started with Burp Suite

A practical introduction to Burp Suite's core tools, showing how Proxy, Repeater, Intruder, and Scanner fit into a modern web testing workflow.

What This Covers

How the main Burp tabs fit together during manual web application testing, from traffic capture to repeatable request analysis.

Target / Lab

Burp Suite Community Edition workflow

Tools Used
Burp ProxyHTTP HistoryRepeaterIntruder
Key Takeaways
  • Use Proxy and HTTP History to map traffic before testing inputs.
  • Use Repeater to validate a single parameter or request change manually.
  • Use Intruder or CLI fuzzers when the same payload needs to be repeated at scale.
// contents
  1. What is Burp Suite?
  2. Proxy
  3. Repeater
  4. Intruder
  5. Other Tools
  6. Typical Testing Workflow

What is Burp Suite?

Burp Suite is an integrated platform for web application security testing made by PortSwigger. It sits between your browser and the target web server, letting you intercept, inspect, and modify every HTTP/S request and response in real time.

The Community Edition is free and covers everything you need to get started — Proxy, Repeater, and a rate-limited Intruder. The Professional edition adds an active scanner and unlimited Intruder speed, which is what the BSCP exam uses.

ℹ️ Setup

To use Burp, configure your browser to send traffic through Burp's proxy (default: 127.0.0.1:8080), then install the Burp CA certificate in your browser to intercept HTTPS without errors. Use the FoxyProxy extension to toggle it easily.

Proxy

The Proxy tab is the core of Burp Suite. It intercepts all HTTP/S traffic flowing between your browser and the target server. Every request passes through here before it's sent, giving you the chance to inspect or modify it.

Intercept

Pause live traffic mid-flight. Toggle it on to hold each request and manually inspect or modify it before forwarding. Toggle off to let traffic flow through automatically.

HTTP History

A running log of every request and response that has passed through the proxy — even when Intercept is off. Your primary browsing audit trail.

The typical workflow: browse the target normally with Intercept off, then use HTTP History to find interesting requests. Right-click any request to send it to Repeater or Intruder for deeper testing.

Repeater

Repeater lets you take a single HTTP request and send it to the server as many times as you want — with manual modifications each time. It's your workbench for testing individual inputs.

ℹ️ Proxy vs. Repeater — what's the difference?

Proxy intercepts live browser traffic. Repeater works on a copy of a request, completely decoupled from your browser. Changes in Repeater don't affect your actual session unless you want them to.

How to send a request to Repeater:

Once in Repeater, you can:

Repeater is where you'll spend most of your time during manual testing — probing for SQLi, XSS, IDOR, authentication bypasses, and anything else that requires tweaking one parameter at a time.

Intruder

Intruder automates sending large numbers of customized requests to a target. You mark positions in a request where payloads will be inserted, supply a list of payloads, and Intruder fires them all.

Common use cases: brute-forcing login credentials, fuzzing parameters for injection, enumerating user IDs, or testing every item in a wordlist.

Attack Types

Sniper

One payload list, inserted into one position at a time. Best for testing a single parameter against many payloads.

Battering Ram

One payload list, inserted into all positions simultaneously. Every request uses the same payload in all positions.

Pitchfork

Multiple payload lists, one per position. Pairs values together — useful for username+password combinations where they're matched.

Cluster Bomb

Multiple payload lists, tries every combination. Generates huge request volumes — use carefully.

⚠️ Community Edition Limitation

Intruder is rate-limited in Community Edition — it throttles requests to slow the attack down significantly. For serious brute-forcing, use ffuf, hydra, or wfuzz from the command line instead.

Other Tools Worth Knowing

Decoder

Encode/decode strings in URL, Base64, HTML, hex, and more. Useful for quickly transforming values you find in requests.

Comparer

Diff two requests or responses side by side. Great for spotting subtle differences between a successful and failed response.

Target → Site Map

Visualizes the application structure as you browse. Shows all discovered endpoints, paths, and parameters in a tree.

Target → Scope

Define what's in scope for the engagement. Burp can filter history and tools to only show in-scope traffic.

Typical Testing Workflow

Here's a rough order of operations when approaching a new web app with Burp:

  1. Set up proxy + browser. Define scope in Target → Scope.
  2. Browse the entire application manually with Intercept off — let HTTP History record everything.
  3. Review HTTP History. Identify interesting endpoints: login, search, file upload, APIs, anything accepting user input.
  4. Send interesting requests to Repeater. Manually probe each input.
  5. For anything requiring iteration (brute-force, fuzzing) — send to Intruder or use a CLI tool.
  6. Use Decoder to analyze any encoded values (tokens, cookies, hidden params).

✅ Key Takeaways

Proxy = intercept and log all traffic. Repeater = manually test and tweak a single request. Intruder = automate across many payloads. Start with Proxy, use HTTP History to find targets, then pivot to Repeater for manual testing. That's 90% of your Burp workflow.

Move through the archive

Browse all posts
Newer post Understanding Linux Privilege Escalation 2025-07-30 . ~8 min read Older post Hosting a Local Website with XAMPP and LocalToNet 2025-07-22 . ~4 min read

Related posts

Posts that overlap with the same tools, techniques, or target areas.

← Back to blog