Burp Suite Complete Beginner Guide 2026

Burp Suite operates as an intercepting proxy — it sits between your browser and the target web application, capturing every request and response. This gives you total visibility and control over web traffic. It is used in 99% of web application penetration tests.

Burp Suite comes pre-installed on Kali Linux. On other platforms, download the installer from portswigger.net. Burp requires Java 21+ which is bundled in the installer.

• 1
  Launch Burp Suite and select Temporary project for quick testing (or save project for assessments)
• 2
  Select Use Burp defaults for initial configuration
• 3
  Click Start Burp — you're now inside the Burp Suite dashboard
• 4
  Familiarize yourself with the top tabs: Proxy, Target, Repeater, Intruder, Scanner, Decoder, Sequencer, Extender

Burp Suite listens on 127.0.0.1:8080 by default. You need to point your browser at this proxy so that Burp can intercept all traffic. Firefox is recommended for Burp testing because it has its own proxy settings, independent of the OS.

• 1
  Open Firefox → Settings → search "proxy" → click Settings... under Network Settings
• 2
  Select Manual proxy configuration
• 3
  Set HTTP Proxy: 127.0.0.1, Port: 8080
• 4
  Check "Also use this proxy for HTTPS"
• 5
  Click OK and confirm in Burp: Proxy → Options → Proxy Listeners should show 127.0.0.1:8080 running

Chrome uses the OS system proxy settings, so you need to configure it via command line or use an extension like SwitchyOmega.

To intercept HTTPS traffic, Burp issues its own TLS certificates signed by a Burp CA. Your browser needs to trust this CA, otherwise you'll get SSL errors on every HTTPS site. This is a one-time setup per browser.

• 1
  With browser proxy configured, navigate to: http://burp (or http://127.0.0.1:8080)
• 2
  Click "CA Certificate" button at the top right — downloads cacert.der
• 3
  Firefox → Settings → Privacy & Security → Certificates → View Certificates
• 4
  Authorities tab → Import → select the downloaded cacert.der
• 5
  Check "Trust this CA to identify websites" → OK
• 6
  Test: visit https://example.com with Burp intercepting — no SSL error = success

The Proxy tab is Burp's heart. The "Intercept" sub-tab lets you pause requests before they reach the server. "HTTP history" shows every request/response that has passed through Burp — this is where you do most of your initial analysis.

• 1
  Intercept On/Off: When ON, each request pauses and waits for your action (Forward/Drop/Send to Tool). Turn OFF when just browsing to collect history.
• 2
  HTTP history: Browse to your target with Intercept OFF — all requests populate here. Right-click any request → "Send to Repeater", "Send to Intruder", "Add to scope".
• 3
  Request view: See the raw HTTP request. Every parameter, cookie, and header is visible and editable.
• 4
  Response view: See the server's raw response. Look for interesting data, tokens, error messages, and stack traces.
• 5
  Scope: Set your target scope (Target → Scope) to filter history to only your target domain and avoid accidental testing of other sites.

Repeater is your primary tool for manual vulnerability testing. You send a request here from Proxy History, then modify and resend it as many times as you want — testing different payloads, parameter values, and observing the target's response each time.

• 1
  In HTTP History, find an interesting request (login, search, API call) → right-click → "Send to Repeater"
• 2
  Click the Repeater tab → you'll see the raw HTTP request on the left
• 3
  Modify the request: change a parameter value, add headers, inject a test payload like ' or <script>
• 4
  Click Send → inspect the response on the right for errors, different behavior, or data exposure
• 5
  Use the arrow keys to navigate request history — compare responses to understand what each change triggers

Intruder automates sending a large number of modified requests, making it ideal for brute force attacks, fuzzing parameters, and credential testing. In Community Edition, requests are rate-throttled but the functionality is the same.

• 1
  Send a login request from HTTP History to Intruder (right-click → Send to Intruder)
• 2
  In Intruder → Positions tab: click Clear § to remove auto-detected positions
• 3
  Highlight the username value → click Add §. Do the same for password value. Select Pitchfork attack type
• 4
  Payloads tab: Payload set 1 = usernames list, Payload set 2 = passwords list. Load from file or paste values
• 5
  Click Start attack → sort results by Status Code or Response Length — a different response length often indicates a valid credential

Burp Pro's Scanner automatically identifies vulnerabilities like XSS, SQL injection, SSRF, and more. Community Edition includes Passive Scanner only, which flags issues like information disclosure and insecure headers without sending additional requests.

• 1
  Passive scan: Automatic — Burp analyzes all proxied traffic as you browse and flags issues in the Issues panel
• 2
  Active scan (Pro): Right-click any request → "Scan" → choose "Active scan" or "Audit" to send crafted payloads
• 3
  Review findings in Target → Issues tab — sorted by severity (Critical/High/Medium/Low/Info)
• 4
  Click any finding for detail: description, evidence, request/response, remediation advice

Decoder converts data between encoding formats (URL, Base64, HTML, Hex) — critical for understanding and crafting tokens and payloads. The BApp Store (Extender tab) provides community extensions.