Burp Suite

What is Burp Suite?

Burp Suite is the go-to tool for testing web applications, developed by PortSwigger. It works as an intercepting proxy: it sits between your browser and the site you are testing, so you can see, pause and modify every HTTP request and response. Around that it bundles a set of modules (Repeater, Intruder, Decoder, Comparer, scanner…) that make it the daily workbench of pentesters and bug hunters.

There are several editions: Community, free; Professional, paid, with the automated scanner, unrestricted Intruder and Burp Collaborator; and an enterprise edition aimed at large-scale automated scanning. Check current pricing on the PortSwigger website.

What Burp Suite is used for

• Understanding an application: the proxy history and site map show every route, parameter and header it uses.
• Manually testing vulnerabilities: SQLi, XSS, IDOR, SSRF, authentication or access control flaws.
• Automating attacks such as brute force, parameter fuzzing or enumeration with Intruder.
• Bug bounty: it is the standard tool in bounty programmes.
• Testing APIs: REST, GraphQL or the calls of a mobile app configured to use the proxy.

Only use it against your own applications, labs, or systems you have written authorisation to test.

How to install and configure Burp Suite

1. Download Burp Suite Community from portswigger.net/burp (Windows, macOS and Linux). On Kali Linux it comes preinstalled: run burpsuite.
2. Create a temporary project and start with the default settings.
3. Go to the Proxy tab and open Burp's built-in browser. It is the easiest route: it comes preconfigured and avoids certificate issues.
4. If you prefer your own browser, set it to use the proxy 127.0.0.1:8080 (for example with FoxyProxy), visit http://burpsuite and install Burp's CA certificate to intercept HTTPS.

You can also route command-line tools through Burp:

curl -x http://127.0.0.1:8080 -k https://target.local/login
sqlmap -u "https://target.local/item?id=1" --proxy=http://127.0.0.1:8080

Practical workflow

1. Proxy and interception

With Intercept on, each request is held before reaching the server. You can change parameters, cookies or headers and click Forward. The usual approach is to leave it off and review the HTTP history, turning it on only when needed.

2. Repeater

Right-click a request and choose Send to Repeater (or Ctrl+R). There you can modify and resend it as many times as you like. For example, testing a possible IDOR by changing an identifier:

GET /api/users/1002/profile HTTP/1.1
Host: target.local
Cookie: session=YOUR_SESSION

If your session lets you see another user's profile, there is an access control flaw.

3. Intruder

With Ctrl+I you send a request to Intruder, mark the positions to attack and load lists of values. Its attack types are Sniper, Battering ram, Pitchfork and Cluster bomb. In Community it runs throttled, which is enough for learning.

4. Decoder and Comparer

Decoder encodes and decodes Base64, URL, HTML or hex; Comparer highlights differences between two responses, very handy for spotting blind injections.

Pro tips

• Define the scope (Target → Scope) and filter the history so you do not drown in third-party requests.
• Install extensions from the BApp Store: Autorize (access control), Logger++, JWT Editor or Param Miner are very common.
• Learn the keyboard shortcuts: they save a huge amount of time.
• To practise with labs built for Burp, use PortSwigger's free Web Security Academy, from the same vendor.

Pros and cons

Pros	Cons
Industry standard for web pentesting	Scanner and Collaborator only in Professional
Free and very capable Community edition	Throttled Intruder in the free version
Huge extension ecosystem	Fairly memory-hungry on large projects

Burp Suite alternatives

• OWASP ZAP: free, open-source proxy and scanner, the most complete free alternative.
• sqlmap: to automate SQL injections you have found with Burp.
• Caido: a newer, lighter proxy that is gaining popularity.

Frequently asked questions

Is Burp Suite free?

The Community edition is free. Professional and the enterprise edition are paid; check current pricing on the PortSwigger website.

What is the difference between Burp Suite Community and Professional?

Professional adds the automated vulnerability scanner, unthrottled Intruder, Burp Collaborator for detecting out-of-band interactions and the ability to save projects.

Why is Burp not intercepting HTTPS?

Almost always because Burp's CA certificate is missing from the browser. Use the built-in browser or install the certificate from http://burpsuite.

Is it legal to use Burp Suite?

Yes, it is a legitimate tool. What is illegal is using it against applications without the owner's authorisation.

If you want to practise web methodology step by step with challenges and exercises, you will find it at the Hackers en Acción Academy.