Burp Suite as a Proxy for Web Application Penetration Testing: Complete Guide with Examples

Burp Suite is the de facto standard in the toolkit of any web application security specialist. Its proxy module allows for real-time interception, analysis, and modification of HTTP/HTTPS traffic between the browser and the server. In this guide, we will cover how to set up Burp Suite as a proxy, which modules to use for basic pentesting, and how to avoid common beginner mistakes.

What is Burp Suite and why is it needed by a pentester

Burp Suite is an integrated platform for web application security testing developed by PortSwigger. The tool exists in three editions: Community (free), Professional, and Enterprise. For most entry-level and intermediate tasks, the Community version is sufficient, although the Professional version provides access to an active vulnerability scanner and advanced Intruder capabilities.

The main role of Burp Suite in pentesting is that of a man-in-the-middle proxy. The tool sits between your browser and the target web application, intercepting all HTTP/HTTPS traffic. This allows you to:

• See the "raw" requests and responses that the browser hides from the user
• Modify request parameters on the fly — change headers, POST request body, cookies
• Repeat requests with modified data without reloading the page
• Automatically iterate over parameter values to find vulnerabilities
• Build a complete map of the web application (Spider/Crawler)
• Find vulnerabilities like SQLi, XSS, IDOR, SSRF, and dozens of others

Burp Suite is used by both professional pentesters on commercial projects and participants in Bug Bounty programs (HackerOne, Bugcrowd). It is the first tool that is installed on a workstation when starting a career in Application Security.

⚠️ Important:

Use Burp Suite only for testing applications for which you have written permission from the owner, or for educational environments (DVWA, WebGoat, HackTheBox, TryHackMe). Unauthorized testing is punishable by law.

How proxy interception works in Burp Suite

When you launch Burp Suite and activate the Proxy module, a local proxy server is started on your machine. By default, it listens on the address 127.0.0.1:8080. The browser is configured to use this address as an HTTP/HTTPS proxy.

The workflow looks as follows:

Browser
   │
   │  HTTP/HTTPS request
   ▼
Burp Suite Proxy (127.0.0.1:8080)
   │
   │  ← Here Burp intercepts, displays, and allows modification
   │
   ▼
Target web server (example.com)
   │
   │  HTTP/HTTPS response
   ▼
Burp Suite Proxy
   │
   │  ← Here Burp intercepts the server's response
   │
   ▼
Browser (receives the response)
  

For HTTPS traffic, Burp Suite generates its own TLS certificates for each domain on the fly. To prevent the browser from displaying warnings about an insecure connection, you need to install the Burp root CA certificate in the trusted certificate authorities of the browser or operating system. This is what allows HTTPS traffic to be decrypted — without this step, you will only see encrypted data.

The Intercept mode can be turned on or off. When Intercept is on, each request is "frozen" in Burp and waits for your decision: to pass it as is, modify it, or drop it. When it is off, Burp passes the traffic transparently but still logs it in HTTP History.

Configuring the browser and installing the CA certificate

This is the most important step to get started. Let's consider two options: using Burp's built-in browser and manually configuring Chrome/Firefox.

Option 1: Burp Suite's built-in browser (recommended for beginners)

Starting from version 2021.x, Burp Suite comes with a built-in Chromium browser that is already configured to work with the proxy and contains the CA certificate. This is the fastest way to get started:

1. Open Burp Suite → go to the Proxy section
2. Click the Open Browser button
3. A Chromium window will open, already configured for the Burp proxy
4. Navigate to the desired website — traffic will be intercepted immediately

Option 2: Manual configuration of Firefox

Firefox is preferred for manual configuration as it has its own certificate store (not dependent on the system):

Step 1. Configure the proxy in Firefox:

1. Open Firefox → Settings → Proxy Server (or use the FoxyProxy extension)
2. Select "Manual proxy configuration"
3. HTTP Proxy: 127.0.0.1, Port: 8080
4. Check "Use this proxy for HTTPS"
5. Click OK

Step 2. Install the Burp CA certificate:

1. Make sure Burp Suite is running and the proxy is active
2. In the browser, navigate to: http://burpsuite or http://127.0.0.1:8080
3. Click "CA Certificate" — a file cacert.der will be downloaded
4. In Firefox: Settings → Privacy & Security → Certificates → View Certificates
5. Tab "Authorities" → Import → select the downloaded file
6. Check "Trust this CA to identify websites"
7. Click OK

After these steps, Firefox will trust the certificates that Burp generates for HTTPS sites, and you will be able to intercept encrypted traffic without warnings.

Intercepting and analyzing HTTP/HTTPS traffic

After configuring the browser, you can start working with traffic. Let's explore the main features of the Proxy tab in Burp Suite.

HTTP History — log of all requests

The HTTP History tab (Proxy → HTTP History) is a log of all requests that have passed through Burp. Here you will see:

• Request method (GET, POST, PUT, DELETE, etc.)
• URL and parameters
• HTTP headers (including Cookie, Authorization, User-Agent)
• Request body (for POST/PUT)
• Server response code (200, 302, 403, 500...)
• Response size and time

Right-clicking on any request gives you a context menu with options: send to Repeater, Intruder, Scanner, Decoder, and other modules. This is the main workflow in Burp.

Intercept — active interception mode

Turn on Intercept (the "Intercept is on/off" button) — and the next request from the browser will be "frozen" in Burp. You will see its contents and can:

• Forward — pass the request without changes
• Drop — discard the request (the server will not receive it)
• Manually modify data — edit any field and click Forward
• Action → Send to Repeater — send to Repeater for further analysis

Practical example: you intercept a POST request from a login form. In the request body, you see the parameters username=admin&password=12345. You can change the values directly in Burp and click Forward — the server will receive the modified data.

Key modules: Repeater, Intruder, Scanner

Burp Suite is not just a proxy. It is a whole ecosystem of tools. Let's look at three modules that are used most frequently.

Repeater — manual request testing

Repeater is the workhorse of the pentester. You send a request from HTTP History to it (right-click → Send to Repeater), after which you can:

• Modify any request parameters
• Resend the request using the Send button
• See the server's response in the right panel
• Compare responses to different request variants
• Save the history of all sent variants

A typical scenario for using Repeater: you found the parameter id=5 in a GET request. You send the request to Repeater and start checking: what happens with id=1, id=0, id=-1, id=999999? This is a basic check for IDOR (Insecure Direct Object Reference).

Intruder — automated enumeration

Intruder allows you to automatically iterate over parameter values using a specified dictionary or pattern. The main attack modes are:

Mode	Description	Use Case
Sniper	One parameter, one dictionary	Brute-forcing a single field
Battering Ram	Multiple parameters, one value	When the same value is needed in multiple places
Pitchfork	Multiple parameters, multiple dictionaries (synchronously)	Iterating login+password from prepared pairs
Cluster Bomb	Multiple parameters, all combinations	Full enumeration of all combinations

In the Community version, the speed of Intruder is artificially limited (about 1 request per second). In the Professional version, there are no restrictions. To bypass this limitation in the Community version, third-party extensions or the ffuf/wfuzz utility can be used in conjunction with Burp.

Scanner — automatic vulnerability scanning (Pro)

The Scanner is available only in the Professional version. It automatically analyzes intercepted requests and looks for vulnerabilities: SQL injection, XSS, XXE, SSRF, Path Traversal, and others. The Community version has passive scanning — Burp analyzes traffic and highlights potentially dangerous areas without active attacks.

Finding common vulnerabilities through Burp Suite

Let's consider practical scenarios for finding the most common vulnerabilities using Burp Suite.

SQL Injection (SQLi)

Basic check for SQLi through Repeater:

1. Intercept a request with a parameter that goes to the database (e.g., id=5 or search=test)
2. Send it to Repeater
3. Add a single quote to the value: id=5'
4. Click Send and examine the response — if the server returns a SQL error or the behavior changes — there is an indication of SQLi
5. Check for boolean injection: id=5 AND 1=1 vs id=5 AND 1=2 — if the responses differ, there is an injection

Reflected XSS

Checking for reflected XSS:

1. Find a parameter whose value is reflected on the response page
2. Send the request to Repeater
3. Insert a test payload: <script>alert(1)</script>
4. Examine the response — if the payload appears in the HTML without escaping, XSS is present
5. Check if the script tag is filtered: try <img src=x onerror=alert(1)>

IDOR (Insecure Direct Object Reference)

One of the most common classes of vulnerabilities in modern web applications:

1. Find requests that access objects by numeric ID: /api/user/profile?id=1234
2. Send it to Repeater
3. Change the ID to another value: id=1235, id=1
4. If the server returns data from another user without an authorization error — this is IDOR

Authorization checks and session management

Burp Suite makes it easy to check authorization mechanisms:

• Copy the request to a protected resource to Repeater
• Remove or change the session cookie value
• Check whether the server returns an authorization error or still provides data
• Check if JWT tokens work when changing the algorithm to none

Burp Suite + external proxy: why it's needed

Burp Suite is a local tool proxy. However, in certain scenarios, a pentester may need to route Burp traffic through an external proxy. Let's discuss when and why this is required.

Scenario 1: Testing from a real IP address

Some web applications have protection based on geolocation or IP reputation. If the target application blocks traffic from data centers or known VPN IPs, the pentester can use residential proxies — they have IP addresses of real home users and appear to the server as regular visitors.

Scenario 2: Bypassing rate limiting during active testing

During active scanning or working with Intruder, the target server may block your IP due to a high number of requests. Rotating through a pool of proxies allows you to distribute the load across different IP addresses. For these tasks, data center proxies are well-suited — they provide high speed and connection stability, which is critical during automated testing.

How to configure an upstream proxy in Burp Suite

Burp Suite supports upstream proxies. Configuration:

1. Open Burp Suite → Settings (or User Options in older versions)
2. Go to Network → Connections → Upstream Proxy Servers
3. Click Add
4. In the Destination host field, specify * (for all hosts) or a specific domain
5. Specify the address and port of the external proxy
6. Select the type: HTTP, SOCKS4, or SOCKS5
7. If necessary, enter the username and password
8. Click OK

# Example configuration of an upstream proxy in Burp Suite:

Destination host: *
Proxy host:       proxy.example.com
Proxy port:       8888
Auth type:        Basic
Username:         your_login
Password:         your_password
Proxy type:       SOCKS5
  

After this configuration, all traffic that Burp sends to target servers will go through the specified upstream proxy. The browser still connects to Burp at 127.0.0.1:8080, and Burp forwards the requests through the external proxy.

Comparison of proxy types for pentesting

Proxy Type	Speed	Anonymity	Use in pentesting
Data Center	High	Medium	Active scanning, Intruder
Residential	Medium	High	Bypassing geoblocking, user impersonation
Mobile	Medium	Very High	Testing mobile APIs, bypassing strict WAF

Tips and common mistakes when working with Burp Suite

Over the years of working with Burp Suite, the pentesting community has compiled a list of typical mistakes made by beginners and proven techniques. Here are the most important ones.

Common mistakes made by beginners

• Forgot to install the CA certificate. Symptom: HTTPS sites show a warning about an insecure connection, traffic is not intercepted. Solution: install the certificate as per the instructions above.
• Intercept is still on. The browser is "stuck" — pages do not load. Solution: go to Proxy → Intercept and click "Intercept is on" to turn off interception.
• Did not add exceptions for system traffic. Burp intercepts traffic from Windows updates, antivirus, etc. Set filters in Proxy → Options → Intercept Client Requests to intercept only the necessary domains.
• Testing the production server without permission. This is illegal. Use only testing environments or applications with explicit permission.
• Ignoring the Target → Site Map tab. Here Burp builds a map of the entire application — all discovered endpoints, parameters, and responses. This is an invaluable source of information during reconnaissance.

Useful techniques

• Match and Replace. In Proxy → Options → Match and Replace, you can set up automatic replacement of values in requests. For example, automatically adding a header or changing the User-Agent to mobile.
• Decoder. The Decoder module allows for quick decoding/encoding of data: Base64, URL-encoding, HTML-entities, Hex. Indispensable for analyzing tokens and parameters.
• Comparer. Allows you to compare two server responses byte-by-byte. Send two similar requests to Comparer and instantly see the difference.
• BApp Store. Burp Suite supports extensions (BApp Store). Popular ones include: Autorize (authorization checks), Logger++ (extended logging), Turbo Intruder (fast enumeration in Community), JWT Editor.
• Save the project. In the Professional version, you can save the project. In the Community version, use Export → Save state to avoid losing HTTP History when closing.
• Use Scope. In Target → Scope, add the domain of the target application. This will allow Burp to filter out irrelevant traffic and not clutter HTTP History with requests to Google, CDNs, etc.

Useful resources for practice

Resource	Type	For whom
PortSwigger Web Security Academy	Free labs + theory	Beginners and intermediate level
DVWA (Damn Vulnerable Web App)	Local stand	Practice without risk
HackTheBox / TryHackMe	Online CTF platforms	Practice real scenarios
WebGoat (OWASP)	Local stand with lessons	Learning OWASP Top 10

Conclusion

Burp Suite is a powerful yet accessible tool for web application security testing. Its proxy module provides complete visibility into HTTP/HTTPS traffic, and the combination of Proxy → Repeater → Intruder covers most manual pentesting tasks. You can start for free with the Community version and free labs from the PortSwigger Web Security Academy — this is the best way to master the tool in practice.

Key steps to get started: install Burp Suite, configure the browser via FoxyProxy, install the CA certificate, add the target domain to Scope — and you are ready to work. After mastering the basic modules, move on to exploring extensions from the BApp Store: Autorize, Turbo Intruder, and JWT Editor will significantly expand your capabilities.

If your pentesting requires testing applications with non-standard geolocation, bypassing IP blocks, or simulating traffic from real users, we recommend setting up an upstream proxy in Burp Suite. For tasks where high anonymity and bypassing IP reputation-based protections are important, residential proxies are well-suited — they provide traffic from real user IP addresses and minimize the risk of blocking during testing.