Burp Suite & Web Proxy Testing
Master Burp Suite Community Edition for web application security testing — intercepting, modifying, and replaying HTTP traffic to find vulnerabilities.
Learning Objectives
- → Configure Burp Suite proxy and browser to intercept HTTPS traffic
- → Use Repeater to replay and modify requests
- → Use Intruder for automated fuzzing and brute force
- → Scan for common vulnerabilities with Burp Scanner
- → Use the Target, Proxy history, and Decoder tools effectively
What is Burp Suite?
Burp Suite is the industry-standard web application security testing platform. It acts as an HTTP/HTTPS proxy between your browser and the target.
Browser → Burp Proxy (127.0.0.1:8080) → Target Application
↑
All traffic captured here
Intercept, modify, replay
Editions:
- Community (free) — manual testing tools
- Professional ($449/yr) — active scanner, automated crawling
- Enterprise — CI/CD scanning
Setup: Intercepting HTTPS
1. Start Burp Suite → Proxy → Options → Listening on 127.0.0.1:8080
2. Configure browser:
Firefox: Settings → Network → Manual proxy → HTTP: 127.0.0.1:8080
Or use FoxyProxy extension for quick toggle
3. Install Burp CA certificate (to decrypt HTTPS):
a. Visit http://burpsuite (while proxy is active)
b. Download CA Certificate
c. Firefox: Settings → Privacy → View Certificates → Import
d. Check "Trust this CA to identify websites"
e. Now all HTTPS traffic is decrypted and re-encrypted by Burp
4. Verify: visit any HTTPS site — you should see traffic in Proxy > HTTP history
Proxy – HTTP History
The history tab shows all intercepted requests:
- Right-click → Send to Repeater (for manual testing)
- Right-click → Send to Intruder (for fuzzing)
- Right-click → Send to Decoder
- Filter by host, method, status, MIME type
Useful columns to enable:
- IP address
- Response length (look for length anomalies)
- Response time (timing attacks)
- Status code
- MIME type
Repeater – Manual Request Modification
Repeater lets you modify and replay individual requests:
1. Capture a login request in Proxy
2. Right-click → Send to Repeater
3. Modify parameters:
- Change user: admin' OR '1'='1'--
- Add headers: X-Forwarded-For: 127.0.0.1
- Remove auth header
4. Click Send — analyze response
5. Iterate: compare response lengths, status codes, timing
Pro tips:
- Ctrl+Space — autocomplete in request editor
- Ctrl+R — send request
- Use multiple Repeater tabs (rename them: SQLi, XSS, Auth)
- Response tab: Pretty/Raw/Hex/Render views
Intruder – Automated Fuzzing
Intruder replaces marked positions with payloads:
Attack Types:
Sniper — one position, one payload list
Battering Ram — same payload in all positions simultaneously
Pitchfork — parallel: position 1 = list 1, position 2 = list 2
Cluster Bomb — all combinations of all payload lists
Example: Username enumeration
1. Capture login request
2. Send to Intruder
3. Mark §username§ as the position
4. Payload: common_usernames.txt
5. Attack → sort by response length (valid users = different length)
Example: Password brute force
1. Mark §username§ and §password§
2. Attack type: Pitchfork
3. List 1: found_usernames.txt List 2: rockyou.txt top 100
4. Sort by status code (200 = success)
Note: Community Edition throttles Intruder — use ffuf or hydra for serious fuzzing
Decoder
Encode/decode data in any format:
URL encode: admin' OR 1=1-- → admin%27+OR+1%3D1--
Base64 decode: eyJhbGci... → {"alg":"HS256"...}
HTML encode: <script> → <script>
Hex encode: A → 41
Hex decode: 41 6c 69 63 65 → Alice
Use for:
- Decoding JWT tokens
- Encoding XSS payloads to bypass filters
- Decoding cookie values
- Base64-encoded parameters
Target – Site Map
Target > Site Map shows the discovered structure:
- Every URL visited in the browser appears here
- Right-click a host → Spider from here (Pro)
- Add to scope to focus testing on specific hosts
- Filter out noise (images, CSS, fonts)
Scanner (Pro) / Active Scan
Right-click any request → Active Scan → Start scan
Reports vulnerabilities: SQLi, XSS, CSRF, open redirect, etc.
Community: Use Burp Scanner via PortSwigger online labs
Free alternatives: OWASP ZAP (java -jar zap.jar)
Useful Burp Extensions (BApp Store)
Active Scan++ — additional scan checks
Param Miner — hidden parameter discovery
Retire.js — detect outdated JS libraries
Logger++ — enhanced logging
JWT Editor — decode/modify/resign JWTs
Hackvertor — transform payloads in-line
SQLiPy — SQLMap integration
OWASP ZAP (Free Alternative)
# Run ZAP
java -jar zap.jar
# Or Docker
docker run -u zap -p 8080:8080 owasp/zap2docker-stable zap-webswing.sh
# ZAP has:
# - Proxy (same as Burp)
# - Active Scanner (free, unlike Burp)
# - AJAX Spider
# - Fuzzer
# - Automated scan: zap-baseline.py script for CI
Common Testing Workflow
1. Map the application
- Browse all features while Burp proxy is on
- Check Target > Site Map for hidden endpoints
- Review JS files for API endpoints
2. Identify interesting requests
- Login/logout
- Data access endpoints with IDs
- File uploads
- URL parameters and hidden fields
3. Test each interesting request
- Modify parameters (IDOR, auth bypass)
- Inject payloads (SQLi, XSS, SSTI)
- Remove auth headers
- Change IDs to other users' values
4. Document findings
- Save Burp project file
- Screenshot request/response pairs
- Note reproduction steps
Set up Burp Suite Community with Firefox: (1) configure proxy on 127.0.0.1:8080, (2) install Burp CA certificate, (3) browse a test app (DVWA or PortSwigger Academy) and capture traffic, (4) find a login request in HTTP history, (5) send it to Repeater and modify the username to 'admin' — observe the response.
Why do you need to install Burp's CA certificate?
What does 'Send to Repeater' allow you to do?
Using Burp Intruder on a DVWA login page: (1) capture a login request and send to Intruder, (2) mark the username and password as injection positions, (3) use Pitchfork with admin/admin, admin/password, admin/1234 etc., (4) identify the correct credentials by response length difference, (5) also try Sniper on the username field with a common username list.
Which Intruder attack type uses separate payload lists for each position simultaneously?
How do you identify a valid username through username enumeration in Intruder?
Capture a JWT token from a login response. Using Burp Decoder: (1) Base64-decode the header and payload, (2) identify the algorithm (alg claim), (3) modify the payload to change role to 'admin', (4) attempt to re-encode (note you cannot resign without the secret — understand why this fails), (5) use Burp JWT Editor extension to attempt the alg:none bypass.
Why can you read a JWT payload without the secret key?