Lesson 9 of 15

Burp Suite Mastery

Burp Suite is the industry-standard tool for web application penetration testing, used by security professionals worldwide. You will learn to use Burp's core features — Proxy, Repeater, Intruder, Scanner, and Decoder — to intercept, modify, and automate attacks against web applications. Proficiency with Burp Suite is one of the most valuable skills a web application pentester can have.

Learning Objectives — Deep Dive

Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.

0/4

In plain English

In simple terms: Master Burp Suite proxy, repeater, intruder, and scanner. This means building enough understanding that you can apply this concept in a real scenario — not just answer a quiz question about it, but actually use it when it matters. Focus on the "why" behind the concept, not just the "what."

Why this matters

Scanning and reconnaissance are the foundation of every real-world penetration test. Before you can find or fix vulnerabilities, you need to know exactly what is running on a network. This is the skill that separates guesswork from methodical, professional security work.

Real-world analogy

Think of it like learning to drive. You do not need to understand how the engine works to drive safely, but knowing the basics helps you diagnose problems and avoid mistakes that could cause accidents. The same principle applies here — foundational knowledge prevents costly errors.

What you will be able to do

Run a professional network scan against an authorized target, interpret the results to build a complete picture of the attack surface, and document your findings in a format that is useful for the next phase of testing.

Beginner tip

Do not try to memorize everything at once. Read through the material once to get the big picture, then go back and work through the lab. The hands-on practice is what makes the concepts stick — passive reading alone will not get you there.

Burp Suite Mastery · Objective 1 of 4

VIDEO

Loading video…

Install and configure Burp Suite

Download Burp Suite Community Edition from portswigger.net/burp/communitydownload and install it on Kali (it is also pre-installed on most Kali versions). Launch Burp Suite and navigate to Proxy > Options to confirm the proxy listener is running on 127.0.0.1:8080. In your browser, configure the proxy settings to use 127.0.0.1 port 8080 for all protocols — in Firefox, go to Settings > Network Settings > Manual proxy configuration. Verify the proxy is working by browsing to any HTTP site and confirming the request appears in Burp's Proxy > HTTP history tab.

Install the Burp CA certificate

Navigate to http://burp in your proxied browser to access the Burp Suite web interface, then click 'CA Certificate' to download the Burp CA certificate file. In Firefox, go to Settings > Privacy & Security > Certificates > View Certificates > Authorities > Import and import the downloaded certificate, checking 'Trust this CA to identify websites'. This certificate allows Burp to perform SSL/TLS interception (man-in-the-middle) on HTTPS traffic, decrypting and re-encrypting it so you can inspect and modify the plaintext content. Without this step, HTTPS traffic will show as unreadable encrypted data in Burp.

Intercept and modify a request

Enable interception in Burp's Proxy tab by clicking the 'Intercept is on' button. Browse to a web application and submit a form — Burp will pause the request and display it for inspection before forwarding it to the server. Modify a parameter value in the intercepted request (for example, change a price from 10.00 to 0.01 or a quantity from 1 to -1) and click Forward to send the modified request. Observe whether the application accepts the modified value — price manipulation and negative quantity attacks are common findings in e-commerce applications that trust client-side input.

Send to Repeater

Right-click any intercepted or logged request in Burp and select 'Send to Repeater'. The Repeater tab allows you to modify and resend the same request as many times as you want without going through the browser. This is the primary tool for manual vulnerability testing — use it to test different payloads, observe how the application responds to boundary values, and confirm vulnerabilities by reproducing them reliably. The Repeater maintains a history of all your modifications, making it easy to compare responses and document your testing steps.

Set up an Intruder attack

Send a login request to Burp's Intruder and mark the password parameter as the injection point using the § delimiters. In the Payloads tab, load a wordlist such as /usr/share/wordlists/rockyou.txt and configure the payload processing rules if needed (for example, to hash passwords before sending). Set the thread count to 1 in the Resource Pool tab to avoid overwhelming the target and triggering lockouts. Note that Burp Community Edition throttles Intruder attacks — for faster attacks, use Hydra or ffuf from the command line instead.

Previous: API Security Testing Next Lesson