/PLAYBOOK · 2026-07-31

Burp Suite Hands-on Intro: Web Security Proxy Capture and Testing

Burp Suite Community walkthrough covering proxy setup, HTTPS CA trust, request intercept and edit, Repeater replay, and Intruder brute force. Includes a four-step config check and FAQ.

Scope

For web app testers, pentesters, and security ops. Use Burp for vuln hunting, API review, or reproducing XSS/SQL injection. Proxy intercept and replay are the starting point. This guide uses Community edition. Covers install, proxy capture, replay, and basic scanning.

Prerequisites

JDK 11+ on the host (`java -version` to confirm)
Burp Suite Community (free from the official site, no license)
Browser that supports proxy config (Chrome or Firefox)
Test only on authorized targets (DVWA, lab ranges). Do not scan unauthorized sites.

How it works

Burp is a MITM proxy. It listens locally (default 127.0.0.1:8080). Browser traffic goes through Burp, then to the target. Responses return the same path. You intercept and edit any field before send: Cookie, payload injection, and so on. Replay with Repeater. Feed requests to Intruder for dictionary brute force, or Scanner (Pro) for auto vuln discovery. The chain is intercept → analyze → replay → brute force. That is core web-test skill.

Steps

1. Install and start

Windows/macOS: run the installer. Linux: distro package or jar:

# Start from jar on Linux
java -jar burpsuite_community_v2026.7.jar

First launch: Temporary project + Use Burp defaults. Then the main UI.

2. Configure browser proxy

Burp listens on `127.0.0.1:8080` by default. Chrome: install Proxy SwitchyOmega, or launch with:

# One-shot Chrome proxy launch
chrome --proxy-server="http://127.0.0.1:8080" --ignore-certificate-errors

Open `http://burp`. Download and trust the CA cert (Proxy > Options > Import/Export CA certificate). HTTPS will not decrypt without it.

3. Intercept and modify requests

Open Proxy > Intercept. Confirm Intercept is on. Browse the target. Requests pause here. Edit Host, Cookie, User-Agent, or params in the Raw pane. Forward to send. Drop to discard. Intercept + param edit is enough to manually check SQL injection and IDOR.

4. Replay with Repeater

In HTTP History, right-click a request. Send to Repeater (Ctrl+R). Edit and click Send. Watch the Response pane. Use this to reproduce bugs and verify payloads.

5. Brute-force params with Intruder

Right-click the request. Send to Intruder (Ctrl+I). On Positions, mark attack positions with §. On Payloads, load a wordlist (weak passwords, path dict). Options: 5-10 threads. Start attack. Filter by response length for outliers:

# Example: generate 100k common-password candidates
for i in $(seq 0 99999); do printf "pass%05d\n" $i; done > pass.txt
# Or use stock lists under /usr/share/wordlists/ (Kali)

Config check

# 1. Proxy up: http://burp shows the Burp info page
# 2. Capture: Proxy > HTTP History lists full requests to the target
# 3. HTTPS: browsing an https site shows plaintext request parameters
# 4. Replay: send a valid DVWA login once; repeating Send in Repeater returns the same response

All four pass means proxy, cert, and replay work. Then start testing.

FAQ

Q1: Browser cannot reach the internet after proxy config?

Confirm Burp Proxy is listening (Proxy > Options, Running checked). Confirm the browser points at the right port. HTTPS cert errors mean the CA is missing or untrusted. Reinstall from `http://burp` and restart the browser.

Q2: Intruder unusable on Community?

Community Intruder is throttled to a very slow mode. Fall back to Repeater plus a script (Python requests loop) for limited brute force. For real pentests use Pro, or OWASP ZAP (open source, similar features).

Summary

The core is the MITM proxy model: intercept, analyze, replay/edit, dictionary brute force. Proxy setup, Repeater, and Intruder apply to any web test. Practice in order: capture to understand traffic, replay to verify vulns, brute force to expand the attack surface. Stay in scope. Test only owned or authorized targets.