🕵️ Burp Suite Overview — Your Web Hacking Workbench

Every web app talks to a server. Burp Suite lets you sit in the middle and watch — or change — that conversation.

🧠 Easy Analogy (Must Read First!)

Think of a postal sorting office.

• You write a letter (your browser sends a request)
• The letter goes to the sorting office (Burp Proxy)
• You open it, read it, even rewrite it
• Then you let it go to the real address (the server)
• The reply comes back through the same office — you can inspect that too

Normally you never see inside the letter. Burp gives you the opening-the-envelope power.

📘 What You Will Learn

• What Burp Suite is and why every web pentester uses it
• Community vs Professional — what you actually get for free
• The main tools: Proxy, Repeater, Intruder, Decoder, Comparer
• How Burp sits between your browser and the server
• Safe, legal ways to practice

❓ What Is Burp Suite?

Burp Suite is an intercepting proxy + web security toolkit made by PortSwigger.

Why does it exist? Browsers hide the raw HTTP traffic. Hackers and testers need to see and edit it. Without that, you can only click buttons the developer gave you.

With Burp, you can test what happens when you:

• Change a price from 500 to 1
• Swap your user ID for someone else's
• Send 1000 login attempts
• Remove a cookie or header

That is how real bugs (IDOR, auth bypass, injection) get found.

🔄 How Burp Works (Flow)

Without Burp:

[ Browser ] ───────────────────────► [ Server ]
            ◄───────────────────────

With Burp:

[ Browser ] ──► [ Burp Proxy ] ──► [ Server ]
                127.0.0.1:8080
                     │
                You see it.
                You edit it.
                You replay it.
                     │
[ Browser ] ◄── [ Burp Proxy ] ◄── [ Server ]

Your browser is told: "send everything to 127.0.0.1:8080." Burp listens there. That is the whole trick.

🧰 The Main Tools

Each tool has one job. Learn the job, not the buttons.

Remember this one: Proxy catches → Repeater experiments → Intruder automates.

⚖️ Community vs Professional

Verdict for a student: Community is enough to learn everything. Buy Pro only when you do paid work.

🚀 Quick Start (5 Steps)

Step 1 — Install Download Burp Suite Community from PortSwigger's official site. Needs no separate Java — the installer bundles it.

Step 2 — Open the embedded browser Go to Proxy → Intercept → Open Browser. This is a Chromium browser already wired to Burp. Why use it? Zero proxy setup, zero certificate headaches.

Step 3 — Turn intercept on Click Intercept is on. Now open any site in that browser. The request freezes inside Burp. Nothing reaches the server yet.

Step 4 — Read and decide You will see raw HTTP like this:

GET /login HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0
Cookie: session=abc123

Click Forward to release it, or Drop to kill it.

Step 5 — Send to Repeater Right-click the request → Send to Repeater. Edit anything, press Send, read the response. Repeat.

🔐 What About HTTPS?

Burp must decrypt HTTPS to show you the content. So it uses its own certificate authority (CA).

• Embedded browser → already trusted, nothing to do
• Your normal browser → visit http://burpsuite while proxied, download the CA cert, install it

Warning: Remove the Burp CA when you finish testing. Anyone with its private key could intercept your traffic.

🎯 Where to Practice (Legally)

Never test a site you do not own or have written permission for. Unauthorized testing is a crime, even if you "just looked."

Safe targets:

⚠️ Common Beginner Mistakes

🎯 Final Summary

Burp Suite = intercepting proxy between browser and server
Proxy      → catch and edit live requests
Repeater   → resend one request with changes
Intruder   → automate many requests
Decoder    → encode/decode data
Community  → free, enough to learn everything
Default listener → 127.0.0.1:8080
Rule #1    → test only what you are authorized to test

📌 Next Tutorial

Burp Suite: Intercept and Modify Requests (Hands-On)

TechWithJuned · Learn → Execute → Build