CCYNARKS LearnLogin
← All tools

Burp Suite

Web Proxy · Intermediate

Intercept, inspect and modify HTTP traffic between your browser and a web app.

Knowledge reference only. Prefer in-browser Labs first. Use this tool only on systems you own or have written authorization to test.

What to learn

  • Proxy & intercept
  • HTTP history
  • Repeater
  • Intruder basics
  • Scope configuration

Legitimate use

AppSec teams use it to verify fixes and test their own applications.

Official docs →

Burp Suite — web assessment workflow

Application security testing (authorized scope only)

  1. 1. Proxy setup

    Configure browser to use 127.0.0.1:8080. Install Burp CA (Proxy → Options → Import/export CA). Verify HTTPS intercept works on a lab URL.

    • CA trusted in browser
    • Intercept toggle understood (Off for browsing, On when needed)

  2. 2. Scope & target mapping

    Target → Scope: add in-scope hosts. Use Site map as you browse to build an inventory of endpoints, methods, and parameters.

    • Scope excludes third-party CDNs unless in scope
    • Note login, API, and admin paths

  3. 3. Traffic analysis

    HTTP history: filter by MIME, status, parameters. Identify state-changing requests, file uploads, JSON APIs, and WebSockets.

    • Session cookies documented
    • Auth headers vs cookie auth noted

  4. 4. Manual testing

    Send interesting requests to Repeater. Test access control (two accounts), input validation, and business logic without running aggressive scans first.

    • IDOR on object IDs
    • Role change attempts on admin routes

  5. 5. Targeted active scan (Pro / lab policy)

    Only after manual review and scope confirmation. Limit scan speed; exclude destructive checks if policy requires.

    • Scan configuration saved
    • Out-of-hours if production

  6. 6. Intruder (rate-aware)

    Use for fuzzing parameters, password spraying in lab, or enumeration — always with authorization and rate limits.

    • Payload set justified
    • Grep match for success criteria

  7. 7. Comparer & Sequencer

    Comparer: diff responses for logic bugs. Sequencer: assess session token entropy in lab apps (not production without approval).

  8. 8. Decoder & extensions

    Decoder: Base64, URL, JWT inspection. Extensions: Logger++, Autorize (authz checks), custom passive scanners — install only from trusted sources.

  9. 9. Reporting

    Each finding: steps to reproduce, impact, evidence (sanitized), remediation. Map to CWE/OWASP where applicable.

Case study: Public bug bounty reports often cite Burp Repeater for IDOR and SSRF validation — methodology matches OWASP WSTG; always stay within program rules.

Example commands (lab VMs only)

  • Proxy → Intercept on
    Capture a request from the built-in browser
  • Send to Repeater
    Modify and resend a request to a lab app