Hacking Web Applications · Module 14
Burp Suite
Intercepting proxy for finding and testing web-application flaws.
Safe to try on your own machine. Spin up your Kali Linux lab and practice away — on any system you own or have permission to test. That’s exactly how the pros learn.
Definition
Burp Suite is a web application security testing platform developed by PortSwigger.
Intercept, inspect, modify and analyze HTTP/HTTPS traffic to identify potential web application vulnerabilities.
Web application penetration testing, vulnerability assessment, and authorized security research.
Key features
Intercepts and inspects HTTP/HTTPS between the browser and server.
Manually modify and resend requests to analyze behavior.
Automates customized request sequences for authorized testing.
Automatically detects vulnerabilities (depends on edition).
Encode/decode data and compare requests or responses.
Restrict testing to explicitly selected applications and hosts.
Important commands & actions
ProxyIntercept and examine web traffic.
RepeaterManually resend modified HTTP requests.
IntruderAutomate customized request sequences.
DecoderEncode and decode application data.
HTTP HistoryReview previously captured traffic.
Target ScopeLimit testing to authorized targets.
Practical examples
- Open Burp Suite and start a temporary project.
- Open Burp's browser and visit your authorized test app.
- Open Proxy -> Intercept and inspect the captured request.
Purpose Understand how the browser talks to the web application.
- Capture a request and send it to Repeater.
- Modify a harmless parameter.
- Click Send and compare the response.
Purpose Observe how the app responds to controlled input changes.
- Open the Decoder tool.
- Enter a sample string from your test environment.
- Choose a decode operation (e.g. Base64 'SGVsbG8=' decodes to 'Hello').
Purpose Inspect encoded data encountered during testing.
Important points
- HTTPS interception: Requires a browser configured to trust Burp's CA certificate.
- Proxy configuration: The browser must route traffic through Burp's proxy.
- Scope: Define the authorized target scope before testing.
- Active testing: Scanner and Intruder can generate heavy traffic or modify data.
- Responsible testing: Use a local lab or a system you have explicit permission to test.
Common use cases
Inspect and manipulate HTTP requests and responses.
Examine how apps handle modified inputs.
Assess login and session-management behavior.
Check whether users can reach resources beyond their permissions.
This tool is taught in Module 14
Read the full written notes, with diagrams, defense and detection.