⚠️ Authorized testing only. Everything here is for use only against systems you own or have explicit written permission to test — home labs, CTFs, and authorized engagements. Unauthorized access is illegal. See Rules of Engagement and Authorization.
Burp Suite is the core web-app testing proxy: it sits between your browser and the target so you can read, modify, and replay every request.
1. Proxy setup
- Set browser proxy to
127.0.0.1:8080(use the Burp browser or FoxyProxy). - Install Burp's CA cert (
http://burp/cert) so HTTPS doesn't error. - Proxy → Intercept toggles request pausing.
2. Repeater — manual testing
Send any request to Repeater (Ctrl+R) to hand-craft and resend it. This is where you test injection, auth bypass, and parameter tampering one request at a time.
3. Intruder — automated fuzzing
Mark positions with §, then pick an attack:
| Attack type | Use |
|---|---|
| Sniper | One payload set, one position (most common) |
| Cluster bomb | Multiple positions, all combinations (cred stuffing) |
| Pitchfork | Parallel payload sets |
4. Workflow
Recon → map the app (proxy while browsing), Target → Site map to see structure, send interesting requests to Repeater, automate with Intruder, decode with Decoder, compare responses with Comparer.
Useful extensions (BApp store): Logger++, Autorize (authz testing), Param Miner (hidden params). Then dig into SQL Injection and XSS, SSRF and IDOR.