Introduction to Burp Suite

Burp Suite is the industry-standard tool for web application security testing. This guide covers essential features and techniques for effective penetration testing.

Setting Up Burp Suite

Installation

1. Download from PortSwigger website
2. Configure Java runtime if needed
3. Launch and configure browser proxy

Browser Configuration

Proxy Settings:
Host: 127.0.0.1
Port: 8080

Install the Burp CA certificate for HTTPS interception.

Core Tools

Proxy

The heart of Burp Suite - intercepts all browser traffic:

• Intercept: Modify requests before sending
• HTTP History: Review all captured traffic
• WebSockets: Monitor WebSocket communications

Scanner (Pro)

Automated vulnerability detection:

• Active scanning
• Passive analysis
• Crawling capabilities

Repeater

Manual request manipulation:

1. Send request to Repeater
2. Modify parameters
3. Analyze responses
4. Iterate and test

Intruder

Automated attacks:

• Sniper: Single payload position
• Battering Ram: Same payload everywhere
• Pitchfork: Multiple payload sets
• Cluster Bomb: All payload combinations

Advanced Techniques

Testing for SQL Injection

Original: id=1
Test: id=1'
Test: id=1 AND 1=1
Test: id=1 AND 1=2

XSS Detection

Use Burp's built-in payloads or custom lists:

<script>alert(1)</script>
<img src=x onerror=alert(1)>
"><script>alert(1)</script>

Session Analysis

• Compare logged-in vs logged-out responses
• Identify session tokens
• Test for session fixation

Extensions

Essential Extensions

• Logger++: Enhanced logging
• Autorize: Authorization testing
• Param Miner: Hidden parameter discovery
• Turbo Intruder: High-speed testing

Installing Extensions

1. Go to Extender tab
2. BApp Store
3. Install desired extensions

Best Practices

1. Scope Definition: Limit testing to authorized targets
2. Documentation: Keep detailed notes
3. Rate Limiting: Don't overwhelm the target
4. Backup Configs: Save project files regularly

Conclusion

Mastering Burp Suite takes practice. Start with the basics and gradually explore advanced features. The tool's flexibility makes it invaluable for web application security testing.