Security Testing

Burp Suite Beginner's Guide: Web Application Security Testing

HelpMeTest

HelpMeTest

— 3 min read
Burp Suite Beginner's Guide: Web Application Security Testing

Burp Suite is the standard tool for web application security testing. Security engineers use it to intercept HTTP traffic, find vulnerabilities, and test how applications respond to malicious input. This guide covers the fundamentals for getting started.

Note: This guide is for authorized security testing only — penetration testing engagements, bug bounty programs, and testing applications you own or have explicit permission to test.

What Is Burp Suite?

Burp Suite is a Java-based platform from PortSwigger designed for web application security testing. It functions as an intercepting proxy — all browser traffic flows through Burp, where you can inspect, modify, and replay requests.

Editions:

  • Burp Suite Community — free, includes proxy, repeater, decoder, and manual tools
  • Burp Suite Professional — paid (~$449/year), adds automated scanner, intruder (full), and advanced features
  • Burp Suite Enterprise — for continuous automated scanning at scale

Most beginners start with Community edition, which covers the core manual testing workflow.

Installation

Download from portswigger.net/burp/communitydownload.

Burp runs on Java (OpenJDK 17+). On macOS/Linux, run the JAR:

java -jar burpsuite_community_v2024.jar

Or use the native installer for your platform.

Setting Up the Proxy

Burp's proxy listens on 127.0.0.1:8080 by default.

Configure your browser:

  • In browser network settings, set HTTP proxy to 127.0.0.1:8080
  • Or install FoxyProxy extension for easy proxy switching

Install Burp's CA certificate:

  1. With the proxy running, browse to http://burp in your configured browser
  2. Download the CA certificate
  3. Install it in your browser's certificate store (trusted root authorities)

Without the CA cert, Burp can't intercept HTTPS traffic (you'll see certificate errors).

Verify the setup:

  1. Go to Burp → Proxy → Intercept
  2. Browse to any website
  3. You should see the intercepted request in Burp

The Proxy Tab

The proxy is Burp's core. Requests flow through it, and you can:

Intercept mode ON:

  • Each request pauses for your review
  • You can modify headers, parameters, body before forwarding
  • Click "Forward" to send, "Drop" to discard, "Action" for options

Intercept mode OFF:

  • Requests pass through automatically
  • Still logged in HTTP history

The HTTP History subtab shows all traffic that passed through Burp — every request and response, searchable and filterable.

Repeater: Manual Request Manipulation

The Repeater tab lets you send a request and modify it repeatedly:

  1. In HTTP History, right-click a request → Send to Repeater
  2. Go to the Repeater tab
  3. Modify the request (change parameters, headers, body)
  4. Click Send
  5. View the response on the right
  6. Repeat with different modifications

Repeater is essential for:

  • Testing how the app handles unexpected input values
  • Bypassing client-side validation (modify the request directly)
  • Testing authentication and authorization (change user IDs, session tokens)
  • Manually confirming vulnerabilities found by the scanner

Scope Configuration

Scope limits Burp to your target application. Without scope, Burp captures all browser traffic including Google, CDN resources, and anything else your browser touches.

Set scope in Target → Scope:

  1. Click Add → Enter your target URL
  2. In the Proxy tab, enable "And URL Is in target scope" to filter history

Now HTTP History shows only traffic to your target.

The Target Tab

The Target → Site Map shows the application structure discovered from your browsing:

  • Every URL visited
  • Every parameter observed
  • Files and directories discovered

This gives you a map of the application's attack surface before you start testing.

Spider (Crawler)

Available in Professional edition for automated crawling.

In Community edition, you can manually browse the application while Burp records everything. Every page you visit gets added to the site map.

For a more thorough manual approach:

  1. Set your scope
  2. Browse the application completely — click every link, submit every form
  3. Review the site map to see what was discovered

Decoder

The Decoder tab converts between encodings:

  • URL encode/decode
  • HTML encode/decode
  • Base64 encode/decode
  • Hex, binary, ASCII85

Useful when you find encoded parameters in requests and want to see (or modify) their decoded values.

Basic Vulnerability Testing Workflow

With Community edition, the workflow is manual:

  1. Browse the application — log in, use all features, let Burp capture everything
  2. Review HTTP History — look for interesting requests (login, file upload, ID parameters)
  3. Send to Repeater — take interesting requests to Repeater for manipulation
  4. Test input handling — try SQL injection patterns, XSS payloads, IDOR (changing user IDs), path traversal
  5. Analyze responses — look for error messages, unexpected data in responses, behavior differences

For automated scanning, Burp Suite Professional's scanner does this systematically.

Common Findings to Test

SQL injection: Add ' or " to parameters and look for SQL errors in responses.

XSS: Add <script>alert(1)</script> to text input parameters. Look for it reflected in the response without encoding.

IDOR (Insecure Direct Object Reference): Find requests with IDs (user IDs, order IDs). Change the ID to another user's ID and see if you get their data.

Authentication issues: Try accessing authenticated pages without a valid session cookie. Try accessing admin endpoints with a regular user session.

Learning Resources

PortSwigger provides Web Security Academy (free) — hands-on labs that teach each vulnerability type using Burp Suite in a deliberately vulnerable application. It's the best structured learning path for web application security testing.

Related:

Read more

Start now free