E-BUR
Burp Suite
Intercepting proxy and web lab; Community is free, Professional is paid.
OVERVIEW
Burp Suite sits as a proxy between the browser and the application: it intercepts every HTTP(S) request and response, letting you modify them before they reach their destination. On top of that sit Repeater (resend and tweak requests by hand) and Intruder (automate variations against a parameter).
Community Edition covers the proxy, Repeater, and a throttled Intruder; Professional adds the automated active scanner, unthrottled Intruder, and team-collaboration integrations.
USE CASES
Practical use cases
- 01
Intercepting and tampering with requests to test business logic and server-side validation.
- 02
Testing authentication, session handling, and access control by replaying requests from Repeater.
- 03
Automating targeted parameter fuzzing with Intruder.
- 04
Mapping the application's surface by browsing it through the proxy before a targeted scan.
QUICK START
The day-to-day workbench for HTTP(S) apps: intercept, replay requests, and map the application with authorization.
- Configure the browser (or use the embedded Chromium) to route through Burp's proxy.
- Browse the application normally to populate the site map.
- Send interesting requests to Repeater to tweak and resend them.
- Use Intruder when you need to automate variations against the same parameter.
BEFORE YOU RUN IT
What to check before running it
Unthrottled Intruder in Community can saturate the app or trip the WAF — tune the throttling manually.
Set scope in the Target tab before scanning so you don't touch hosts outside the engagement.
Professional's active scanner fires real payloads: only use it when the client has explicitly authorized it.