Burp Suite — Web Proxy GuideStep-by-step Burp Suite reference: intercept, Repeater, Intruder and Decoder on your own lab apps (PortSwigger labs, DVWA). Educational use only.FAQ

What is Burp Suite?

Burp Suite is the standard web-hacking proxy: your browser sends traffic through it, and it shows every request and response so you can read, pause, edit and replay them. Security testers use it to find broken access control, injection and logic bugs in web apps.

Is Burp Suite illegal?

The Community Edition is free and legal for learning. Routing someone else's traffic through it or testing sites you do not own is illegal. Practice on PortSwigger's free Web Security Academy labs or DVWA on localhost.

What is Intercept?

Intercept pauses each browser request inside Burp before it reaches the server, so you can read and edit it — change a price, a user ID, a role — then forward it. That is how testers prove the server trusts client input too much.

What is Repeater?

Repeater lets you resend one request again and again with small edits and compare responses. Change one parameter at a time and watch what the server does — the core loop of manual web testing.

What is Intruder?

Intruder automates payload lists through marked positions: usernames, passwords, IDs. In Community Edition it is rate-limited (single thread), which is fine for labs. Mark positions with add markers, pick a payload list, start the attack.

How do I make my browser trust Burp?

Burp re-signs HTTPS with its own CA certificate, so install it: with the proxy on, visit http://burpsuite, download cacert.der, and import it into your browser as a trusted authority. Without this step HTTPS sites show certificate errors.

What is Decoder?

Decoder converts data between formats — URL, Base64, hex, HTML entities — so you can read encoded cookies and tokens, edit them, and re-encode. Most session weirdness unravels here.

How do I protect my app from Burp-style testing?

Validate everything server-side, use random CSRF tokens, set HttpOnly + Secure + SameSite cookies, rate-limit logins, and never trust prices, roles or IDs sent by the browser. Then invite testing on your own staging via the free labs.

All tools · Sitemap · Games