Mastering Burp Suite: The Ultimate Guide for Beginners (2025)

Burp Suite is the industry-standard platform for web application security testing. It acts as a proxy between your browser and the target application, giving you complete visibility and control over the traffic. Whether you are a bug bounty hunter or a penetration tester, mastering Burp Suite is non-negotiable.

1. Installation & Setup#

Editions#

• Community Edition: Free. Includes Proxy, Repeater, and Sequencer. Good for manual testing and learning.
• Professional Edition: Paid. Adds the automated Scanner, Intruder (unthrottled), and many other advanced features.

Configuration#

1. Download: Get the installer from PortSwigger.net.
2. Browser Setup:
   • Burp listens on 127.0.0.1:8080 by default.
   • Pro Tip: Use the FoxyProxy browser extension to switch traffic to Burp with one click.
3. CA Certificate:
   • Navigate to http://burp in your browser while Burp is running.
   • Download the CA Certificate.
   • Import it into your browser's "Authorities" store to inspect HTTPS traffic without warnings.

2. The Proxy: Your Command Center#

The Proxy is where it all begins. It allows you to intercept and modify requests in flight.

• Intercept Tab:
  • Forward: Send the request to the server.
  • Drop: Delete the request.
  • Action: Right-click to send requests to other tools (Repeater, Intruder).
• HTTP History:
  • A log of every request/response. Use the filter bar to hide images, CSS, and JS files to focus on the API calls.

3. Repeater: The Manual Testing Lab#

Repeater allows you to modify and resend individual requests. This is where you'll spend 80% of your time.

• Workflow:
  1. Find an interesting request in Proxy History.
  2. Ctrl+R (or Cmd+R) to send it to Repeater.
  3. Modify parameters (e.g., add ' OR 1=1-- to an ID).
  4. Click Send and analyze the response.
  5. Check the Render tab to see how the page looks in a browser.

4. Intruder: Automating Attacks#

Intruder is used for fuzzing and brute-forcing.

Attack Types#

1. Sniper: Uses a single payload set. Places payloads into each position one by one. Good for parameter fuzzing.
2. Battering Ram: Uses a single payload set. Places the same payload into all positions simultaneously.
3. Pitchfork: Uses multiple payload sets. Iterates through them simultaneously (Set 1 Item 1 & Set 2 Item 1).
4. Cluster Bomb: Uses multiple payload sets. Iterates through every combination (Cartesian product). Good for credential stuffing.

Practical Example: Brute Forcing Login#

1. Capture a login POST request.
2. Send to Intruder.
3. Clear positions (§).
4. Highlight the password value and click Add §.
5. Go to Payloads tab and load a wordlist (e.g., rockyou.txt).
6. Start Attack and look for response length or status code changes.

5. Extensions (BApp Store)#

Burp is extensible. The BApp Store contains community-written plugins.

• Turbo Intruder: For extremely fast HTTP requests.
• Autorize: For testing Broken Access Control (IDOR).
• Logger++: Better logging capabilities.
• Retire.js: Detects vulnerable JavaScript libraries.

Conclusion#

Burp Suite is a beast. Don't try to learn everything at once. Start with the Proxy and Repeater loop. Once you are comfortable modifying requests manually, move on to automating with Intruder. The more you use it, the more powerful you become.