Burp Suite - Cybersecurity Academy

🔎 What is Burp Suite?

Burp Suite is an integrated platform for performing security testing of web applications. Developed by PortSwigger, it is widely used by ethical hackers, bug bounty hunters, and professional pentesters to identify and exploit security flaws.

📦 Burp Suite Editions

Community: Free with limited features. Ideal for learning and basic testing.
Professional: Paid version with advanced tools like Burp Scanner, Intruder, and more.
Enterprise: Designed for large-scale automated scanning in corporate environments.

🧩 Core Components

Proxy

Intercepts and modifies traffic between your browser and the target application.

Repeater

Allows manual modification and re-sending of HTTP requests for testing parameter behavior.

Intruder

Automated tool for fuzzing parameters, brute-forcing credentials, and identifying injection points.

Scanner

(Pro version only) Performs passive and active scanning to detect vulnerabilities like XSS, SQLi, and more.

Decoder & Comparer

Used to encode/decode data formats (Base64, URL, etc.) and compare responses.

⚙️ Getting Started with Burp Suite

Step 1: Install Burp Suite

Download from portswigger.net and install for your OS (Windows, Linux, macOS).

Step 2: Configure the Browser Proxy

Set your browser proxy to 127.0.0.1:8080. Import Burp's CA certificate to trust HTTPS interception.

Step 3: Start Intercepting

With "Intercept" enabled, visit a website and view/modify HTTP requests in real time.

🌍 Real-World Use Case: Testing Login Bypass

Example of using Repeater to test login functionality:

POST /login HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

username=admin&password=wrongpassword

After sending the request to Repeater, change password=wrongpassword to a SQL payload like ' OR 1=1-- and observe the response.

💡 Pro Tips

Use extensions from the BApp Store like Autorize, Logger++, and JWT Editor.
Map the target completely before active testing using Spider.
Use Ctrl + Shift + Q to quickly send requests between tabs.
Bookmark interesting requests with comments for later review.

🔌 Recommended Extensions

Autorize: Detect broken access control issues.
Turbo Intruder: High-speed brute forcing.
Logger++: Advanced logging and tracking.
Hackvertor: Encode/obfuscate payloads quickly.
J2EEScan: Vulnerability scanner for Java apps.

⌨️ Useful Keyboard Shortcuts

Ctrl + I: Send request to Repeater
Ctrl + U: URL-decode selected text
Ctrl + Shift + H: Highlight request
Ctrl + F: Search inside a request or response

🧪 Burp Suite