Burp Suite

What is Burp Suite?

Burp Suite is an intercepting HTTP(S) proxy for web application security testing. Community Edition is free; Professional adds scanner/Intruder power.

Intercept, modify, replay, and analyze browser traffic to find authZ, injection, and logic issues in authorized web apps.

Official website: Burp Suite · Documentation

When do you use it?

• Manual web app testing (labs, Juice Shop, PortSwigger Academy, in-scope bounty).
• Need Repeater to craft requests carefully.

When not to use it

• Never point active scans at production without approval and rate limits.
• Out-of-scope third-party CDNs / payment providers.

Who uses it?

• AppSec engineers
• Bug bounty hunters (in-scope)
• Penetration testers

How do you use it? (typical flow)

1. Install Burp Suite using the steps below (prefer Kali package or official installer).
2. Confirm you have authorization for the target (lab VM, own system, or written scope).
3. Run --help / man (or the Help section) to see current flags for your version.
4. Start with a safe example from Basic commands against localhost or an authorized lab target.
5. Record what you ran, what you observed, and any follow-up (filter, report, remediation).

Help & manual (like man / --help)

Every serious tool has a built-in way to look up flags. Learn these first so you are not stuck memorizing every option.

1. 1. In-app help

   Help → Documentation

   Built into Burp UI.

2. 2. Docs

   https://portswigger.net/burp/documentation

   Official manuals.

1. Installation

2. Basic commands

1. 1. Launch (Kali)

   burpsuite

   Starts GUI; configure browser proxy 127.0.0.1:8080.

2. 2. Install CA

   Proxy → Intercept → import Burp CA into browser

   Required for HTTPS intercept.

3. 3. Send to Repeater

   Right-click request → Send to Repeater

   Manual request editing.

Options / flags

5. Useful features

• Proxy / Intercept
• HTTP history & site map
• Repeater
• Intruder (rate-aware, authorized only)
• Decoder / Comparer
• Target scope

6. Practical examples

1. Example 1: Launch (Kali)

   burpsuite

   Starts GUI; configure browser proxy 127.0.0.1:8080.

2. Example 2: Install CA

   Proxy → Intercept → import Burp CA into browser

   Required for HTTPS intercept.

3. Example 3: Send to Repeater

   Right-click request → Send to Repeater

   Manual request editing.

7. Important notes

• AppSec teams use it to verify fixes and test their own applications.
• Authorized targets only — labs, systems you own, or written permission.
• Prefer reading --help / man / official docs for your installed version; flags change over time.