Burp suite

Burp Suite is the primary tool for web application testing. It functions as an intercepting proxy that captures, inspects, and modifies HTTP traffic between the browser and the target application. Its value extends well beyond proxying and the integrated tools supports manual testing workflows from initial mapping through exploitation.

Strategic context

Web application testing requires understanding how the application communicates, what data it sends and receives, and how it responds to unexpected input. Burp Suite provides visibility into this communication that browser developer tools alone cannot match. It captures the full request and response cycle, allows modification and replay of individual requests, and automates repetitive testing tasks.

Burp Suite Professional includes scanning capabilities, but the tool's primary value to a skilled operator is in its manual testing workflow: intercepting traffic, understanding application behavior, and crafting requests based on that understanding.

For security leaders, Burp Suite usage during authorized testing reveals how web applications behave when requests deviate from expected patterns. The vulnerabilities discovered through proxy-based testing are the same vulnerabilities that attackers find using similar tools. Ensuring applications are tested with proxy interception before deployment is one of the most effective ways to prevent web application compromise.

Execution examples

Proxy configuration

Burp Suite listens on 127.0.0.1:8080 by default. Configure the browser to route traffic through this proxy, and install Burp's CA certificate for HTTPS interception.

Scope configuration limits captured traffic to the target domain, reducing noise and keeping the project focused:

Target > Scope > Add target domain
Proxy > Options > Intercept Client Requests > filter by scope

Manual testing workflow

The most productive use of Burp Suite follows a consistent pattern:

1. Browse the application with intercept off, allowing Burp to passively build a sitemap

2. Review the sitemap to understand the application's structure, endpoints, and parameters

3. Identify interesting requests and send them to Repeater for manual testing

4. Modify parameters systematically and observe response differences

Repeater

Repeater allows sending individual requests, modifying them, and immediately viewing the response. Testing for SQL injection, command injection, XSS, and other input-based vulnerabilities happens primarily in Repeater.

Intruder

Intruder automates payload delivery across defined positions in a request. The attack types determine how payloads are applied:

• Sniper: tests one position at a time with a single payload list

• Pitchfork: iterates through multiple payload lists in parallel

• Cluster bomb: tests all combinations of multiple payload lists

Intruder is useful for brute force attacks, parameter fuzzing, and identifying valid values in enumeration scenarios.

Decoder

Decoder handles encoding and decoding operations that are common during web testing: Base64, URL encoding, HTML encoding, and hash generation. It is useful for understanding obfuscated parameters and preparing payloads that survive encoding layers.

Where Burp Suite fits in the lifecycle

• External reconnaissance: mapping web application structure and identifying input points

• Initial access: testing for and exploiting web application vulnerabilities

• Privilege escalation: testing internal web applications discovered after gaining a foothold