Burp Suite Tutorial: Web App Testing for Beginners

A Burp Suite tutorial teaches you to use PortSwigger’s intercepting proxy to find vulnerabilities in web applications. This guide covers installation, CA certificate setup, and the core tools — Proxy, Repeater, and Intruder — using the free Community edition and PortSwigger Web Security Academy labs, so beginners can intercept their first HTTPS request in under an hour.

• Key Takeaway 1: Burp Suite’s free Community edition is enough to learn the fundamentals, including Proxy, Repeater, and manual Intruder attacks.
• Key Takeaway 2: Setting up the Burp CA certificate in your browser is the single most important configuration step, and most beginners skip it.
• Key Takeaway 3: PortSwigger’s Web Security Academy provides free, browser-based labs built specifically for Burp Suite practice.
• Key Takeaway 4: Bug bounty hunters treat Burp fluency as a baseline skill, not a nice-to-have.
• Key Takeaway 5: The Burp Suite Certified Practitioner (BSCP) credential is increasingly recognised by Indian AppSec hiring teams alongside CEH and OSCP.

What Is Burp Suite and Why Does Every Web Tester Use It?

Burp Suite is a Java-based web application security testing platform built by PortSwigger. It sits between your browser and the target server, intercepting every HTTP and HTTPS request so you can inspect, modify, and replay traffic at will. That single capability unlocks almost every web-layer attack class in the OWASP Top 10, making it the essential starting point for any burp suite tutorial.

According to the PortSwigger 2023 Web Hacking Report (portswigger.net/research/web-hacking-in-2023), over 80% of professional web penetration testers use Burp Suite as their primary tool. That number has stayed consistent for years because nothing else matches its combination of manual control and automation in one interface.

Indian security teams at firms like Tata Consultancy Services, Infosys Security, and independent bug bounty hunters on platforms like Bugcrowd, HackerOne, and India-focused Bugbase all list Burp proficiency in job descriptions and scope documents. If you are serious about penetration testing tools, Burp Suite is the one you learn first.

Community Edition vs Professional Edition

The free Community edition gives you the Proxy, Repeater, Decoder, Comparer, and a throttled Intruder. The throttle is real; Community Intruder runs one thread at a time, making large brute-force attacks impractical. For learning this burp suite tutorial, that is fine.

Professional edition costs $449 USD per user per year (PortSwigger pricing, 2024). It unlocks the full Intruder, the automated Scanner, Collaborator for out-of-band testing, and access to the BApp Store extensions. Most Indian freelance bug bounty hunters start on Community and upgrade only when their bounty earnings justify it.

Feature	Community (Free)	Professional ($449/yr)
Intercepting Proxy	Yes	Yes
Repeater	Yes	Yes
Intruder (speed)	Throttled (1 thread)	Full speed, multi-thread
Automated Scanner	No	Yes
Burp Collaborator	No	Yes
BApp Store Extensions	Limited	Full access
Save/Restore Projects	No	Yes

Burp Suite vs OWASP ZAP

OWASP ZAP is free, open-source, and community-maintained. It is excellent for automated scanning in CI/CD pipelines. Burp wins for manual, nuanced testing where you want fine-grained control over every request. Most serious testers use both, with Burp as the primary and ZAP for automated baseline scans.

Burp Suite Tutorial: Step-by-Step Setup for Beginners

Download the Community or Professional installer from portswigger.net. It runs on Windows, macOS, and Linux. Java is bundled, so you do not need a separate JDK install. Launch it, accept the defaults on the project screen, and you are at the main dashboard.

Burp Suite Proxy Setup: Configuring FoxyProxy and the CA Certificate

Burp listens on 127.0.0.1:8080 by default. You need to point your browser’s proxy settings to that address. The cleanest approach is to use the FoxyProxy browser extension, which lets you toggle Burp on and off with one click without changing system-wide proxy settings. Indian learners on Windows laptops running Chrome or Firefox will find FoxyProxy the quickest path to a working setup.

Once the proxy is set, visit http://burpsuite in your browser. You will land on the Burp proxy welcome page. Download the CA certificate from there, then install it as a trusted certificate authority in your browser. This is the step most beginners miss, and without it you will get SSL errors on every HTTPS site. This single configuration step is the most critical part of any burp suite tutorial.

Setting Up a Practice Target: DVWA and PortSwigger Labs

Never practice on live sites you do not own or have written permission to test. That is not just ethical advice, it is the law under India’s Information Technology Act, 2000 and its 2008 amendments.

Use DVWA (Damn Vulnerable Web Application) running locally via XAMPP, or use PortSwigger’s free Web Security Academy labs, which spin up in-browser target apps. The Academy has over 220 labs as of 2024, covering SQL injection, XSS, SSRF, and more, all designed to be solved with Burp Suite. That is the fastest learning path available.

If you want a structured curriculum that pairs Burp skills with a recognised credential, 3.0 University’s CEH v13 program covers web application testing in depth alongside the full ethical hacking syllabus.

Core Burp Suite Tools: How to Use Each One

Burp Suite is not one tool, it is a platform. Understanding what each module does and when to use it is what separates a competent tester from someone who just turns on intercept and hopes for the best.

Burp Proxy: Intercepting HTTP Requests

The Proxy tab is where every burp suite tutorial begins. Switch Intercept to “on”, then perform an action in your browser, like submitting a login form. The request freezes in Burp. You can read every header, parameter, and cookie before it hits the server.

From there you can forward it unchanged, drop it entirely, or edit it before forwarding. This manual inspection is how testers catch things automated scanners miss, like a hidden parameter that controls admin access, or a JWT token that looks suspiciously easy to decode.

The HTTP History sub-tab logs every request even when intercept is off. Get into the habit of browsing your target normally with intercept off, then reviewing HTTP History to map the application before you start attacking anything.

Repeater: Manually Testing One Request at a Time

Right-click any request in the Proxy history and choose “Send to Repeater”. Repeater lets you modify and resend that request as many times as you want, watching the server response change in real time. It is the go-to tool for confirming a vulnerability after you have spotted something suspicious.

Say you notice a user_id=42 parameter in a profile request. In Repeater you would change it to user_id=43 and see if the server returns someone else’s data. That is an IDOR (Insecure Direct Object Reference), one of the most common bugs on Indian bug bounty programmes. Understanding outdated components and web application security gives you more context on why these vulnerabilities persist across so many targets.

Intruder: Automating Payload Injection

Intruder takes a request, lets you mark one or more injection points, and fires a list of payloads at them. The four attack types are Sniper, Battering Ram, Pitchfork, and Cluster Bomb. Sniper is the one you will use most: it cycles one payload list through one injection point at a time.

A practical example: take a login request to Repeater, mark the password field as the injection point, load a common password list, and launch the attack. Watch the response length column. A response that is a different length from the rest usually means something interesting happened.

Remember, on Community edition this runs slowly. For anything serious, Community Intruder is a learning tool, not a production attack tool.

Scanner, Decoder, and Comparer

The automated Scanner (Pro only) crawls and audits the target, flagging issues with confidence ratings. It is useful for quick coverage but it misses logic flaws that only a human would catch. Do not treat its output as a final report.

Decoder lets you encode and decode strings across Base64, URL encoding, HTML entities, hex, and more. You will use this constantly when working with tokens and cookies. Comparer does a diff between two requests or responses, which is handy when you want to see exactly what changed between an authenticated and unauthenticated response.

How Bug Bounty Hunters Use Burp Suite

Bug bounty hunting is one of the fastest-growing career paths in Indian cybersecurity. The HackerOne 2023 Hacker Report (hackerone.com/resources/hacker-report) found that India is the third-largest country by number of registered hackers on the platform, behind only the US and Russia. Burp Suite is central to how those hunters work, and fluency with it is a prerequisite for any serious burp suite tutorial aimed at career outcomes.

A typical bug bounty recon-to-report workflow looks like this:

1. Scope mapping: Browse the entire target application with Burp Proxy running and intercept off. Let HTTP History build a map of every endpoint.
2. Parameter discovery: Use the BApp extension Param Miner (Pro) or manual review to find hidden parameters the application accepts but does not advertise.
3. Manual testing: Send interesting requests to Repeater and probe each parameter for XSS, SQLi, IDOR, and SSRF.
4. Automated sweep: Run Intruder or Scanner against high-value endpoints to catch anything the manual pass missed.
5. Collaborator for OOB: Use Burp Collaborator (Pro) to detect blind SSRF and blind XSS that do not produce visible output in the browser.
6. Report writing: Export request/response pairs from Burp as evidence to include in the bug report.

Hunters who want to formalise these skills should look at the Burp Suite Certified Practitioner (BSCP) exam from PortSwigger. It is a two-app, four-hour practical exam that tests real exploitation, not multiple-choice theory. Pass rates are low, which makes it credible.

If you are building toward a career in AppSec or want to combine Burp skills with a globally recognised qualification, explore bug bounty programs and how they structure learning paths for Indian practitioners.

Frequently Asked Questions

How do I set up Burp Suite?

Download the installer from portswigger.net and run it on Windows, macOS, or Linux. Java is bundled. After launching, point your browser’s proxy to 127.0.0.1:8080 using FoxyProxy, then install the Burp CA certificate from http://burpsuite in your browser. That certificate step is mandatory for intercepting HTTPS traffic without SSL errors.

What is Burp Suite used for?

Burp Suite is used for web application security testing. It intercepts HTTP and HTTPS traffic between your browser and a target server, letting you inspect, modify, and replay requests. Testers use it to find SQL injection, XSS, IDOR, SSRF, authentication flaws, and other OWASP Top 10 vulnerabilities in web apps and APIs.

Is Burp Suite free?

Yes, the Community edition is free and includes the Proxy, Repeater, Decoder, Comparer, and a throttled Intruder. It is fully usable for learning and manual testing. The Professional edition costs $449 USD per user per year and adds the automated Scanner, full-speed Intruder, Burp Collaborator, and complete BApp Store access.

How do I intercept requests with Burp?

Open the Proxy tab and make sure “Intercept is on” is active. Configure your browser to route traffic through 127.0.0.1:8080 and install the Burp CA certificate. When you perform any browser action, the outgoing request freezes in Burp’s Intercept tab. You can read and edit it before clicking Forward to send it to the server.

How do bug bounty hunters use Burp Suite?

Hunters browse the target with intercept off to build an HTTP History map, then send interesting requests to Repeater for manual probing. They use Intruder for payload fuzzing, Param Miner to discover hidden parameters, and Burp Collaborator to detect blind out-of-band vulnerabilities. Exported request/response pairs from Burp form the evidence in their final bug reports.

Last updated: July 2026. Reviewed by the 3University editorial team.