Burp Suite — Web Proxy GuideBurp Suite guide: intercept, Repeater, Intruder and Decoder on your own lab apps like PortSwigger labs and DVWA. Educational lab-only tutorial. 2026 update.FAQ

What is Burp Suite?

Burp Suite is the standard web-hacking proxy: your browser sends traffic through it, and it shows every request and response so you can read, pause, edit and replay them. Security testers use it to find broken access control, injection and logic bugs in web apps.

Is Burp Suite illegal?

The Community Edition is free and legal for learning. Routing someone else's traffic through it or testing sites you do not own is illegal. Practice on PortSwigger's free Web Security Academy labs or DVWA on localhost.

What is Intercept?

Intercept pauses each browser request inside Burp before it reaches the server, so you can read and edit it — change a price, a user ID, a role — then forward it. That is how testers prove the server trusts client input too much.

What is Repeater?

Repeater lets you resend one request again and again with small edits and compare responses. Change one parameter at a time and watch what the server does — the core loop of manual web testing.

What is Intruder?

Intruder automates payload lists through marked positions: usernames, passwords, IDs. In Community Edition it is rate-limited (single thread), which is fine for labs. Mark positions with add markers, pick a payload list, start the attack. As of 2026 the built-in browser and Montoya API are current — keep Burp updated via the built-in updater.

How do I make my browser trust Burp?

Burp re-signs HTTPS with its own CA certificate, so install it: with the proxy on, visit http://burpsuite, download cacert.der, and import it into your browser as a trusted authority. Without this step HTTPS sites show certificate errors.

What is Decoder?

Decoder converts data between formats — URL, Base64, hex, HTML entities — so you can read encoded cookies and tokens, edit them, and re-encode. Most session weirdness unravels here.

How do I protect my app from Burp-style testing?

Validate everything server-side, use random CSRF tokens, set HttpOnly + Secure + SameSite cookies, rate-limit logins, and never trust prices, roles or IDs sent by the browser. Then invite testing on your own staging via the free labs.

All tools · Sitemap · Games