Burp Suite: Complete Guide for Beginners and Professionals
Burp Suite is the ultimate Swiss Army knife for web application and API security. Developed by PortSwigger, it works as a smart interceptor between the browser and the web server, letting you capture, analyze and modify all HTTP/HTTPS traffic in real time to identify critical flaws such as SQL Injection, Cross-Site Scripting (XSS), IDOR and broken access control.
Quick Summary • Burp Suite in Practice
What This Guide Covers:
What This Guide Covers:
- Installation & Updates: Essential steps for Kali Linux and Parrot Security OS.
- Proxy Setup: Local interception on
127.0.0.1:8080and installing the CA certificate for TLS/HTTPS. - 10 Essential Features: Mastering Proxy, Repeater, Intruder, Decoder, Comparer and Scanner.
- Hacker Tips and Secret Commands: High-productivity shortcuts (such as
Ctrl + T,Ctrl + R,Ctrl + Shift + R) and fuzzing techniques. - Complete Video Tutorial: A hands-on video walkthrough of vulnerability testing.
- Community vs. Pro Comparison: A responsive comparison table (desktop) and vertical cards (mobile).
The Life Cycle of an Audit with Burp Suite
Any web application security assessment follows a logical pipeline of four consecutive phases:
AppSec Workflow Architecture
The 4 Stages of Web Application Testing
The 4 Stages of Web Application Testing
01
Proxy & Intercept
Captures all HTTP/S traffic generated by the browser, holding requests for structural analysis.
02
Target & Scope
Maps the directory tree (Site Map) and strictly isolates the domain authorized by the contractual scope.
03
Repeater Testing
Lets you resend the same request over and over with modified parameters without reloading the browser.
04
Decoder & Analysis
Decodes and converts tokens in Base64, URL encoding, JSON Web Tokens (JWT) and authentication parameters.
How to Install and Update Burp Suite on Kali Linux and Parrot OS
Both Kali Linux and Parrot OS ship Burp Suite Community preinstalled in their official repositories. However, it’s essential to keep the binaries and the Java environment up to date to avoid incompatibilities with extensions:
Step 1: Update the Repositories in the Terminal
Sync the package lists and make sure you have the most stable version of the official package:
# Atualiza a lista de repositórios e instala a versão estável
sudo apt update && sudo apt install burpsuite -y
Step 2: Manual Installation with the Official Script (.sh)
If you prefer to download the latest version directly from the PortSwigger website as an installer script:
# Concede permissão de execução ao instalador baixado e executa o assistente
chmod +x burpsuite_community_linux_*.sh
./burpsuite_community_linux_*.sh
Step 3: Allocating RAM for Extensive Pentests (JVM)
For large-scale tests on web systems and heavy APIs, configure the Java Virtual Machine (JVM) with an expanded memory ceiling:
# Inicializa o Burp alocando até 4GB de RAM na JVM
java -Xmx4096M -jar /usr/share/burpsuite/burpsuite.jar &
Video Tutorial: How Ethical Hackers Test Vulnerabilities in Practice
Follow the hands-on, step-by-step video demonstration showing the listener setup, TLS interception and the first tests in Repeater:
Video: Hands-on demonstration of the Burp Suite workflow on Linux systems.
The 10 Most Used Features and Commands in Burp Suite
To operate the tool with maximum efficiency, every security professional should master these 10 core features:
1. Proxy Intercept
Holds the HTTP/HTTPS request before it reaches the server, letting you inject payloads into headers, cookies and body parameters (*body*).
2. HTTP History
Records the chronological history of every request and response browsed, with advanced filters by method (GET/POST), status code and extension.
3. Target Scope
Defines strict scope rules (*Scope*). Ensures only the contracted domain is intercepted, discarding third-party traffic.
4. Target Site Map
Automatically builds the hierarchical tree of directories, API endpoints and static files discovered in the application.
5. Repeater (Ctrl + R)
The most used module day to day. Lets you modify parameters and fire requests repeatedly, comparing the immediate response.
6. Intruder (Ctrl + I)
An automation engine for brute-force testing, parameter fuzzing and ID enumeration (Sniper, Battering Ram, Pitchfork and Cluster Bomb).
7. Decoder
A quick data transformation tool: encode and decode URL, HTML, Base64, hexadecimal, hashes and JWT without leaving the suite.
8. Comparer
Compares two HTTP responses byte by byte or word by word, highlighting subtle variations caused by blind SQL injections or XSS.
9. Extender & BApp Store
The official store of community add-ons in Java and Python (Jython), such as Autorize (for IDOR flaws) and Turbo Intruder.
10. Burp Scanner (Pro)
An automated scanning engine that audits traffic passively and actively for OWASP Top 10 vulnerabilities and CWEs.
💡 Hacker Tips: Secret Commands and Shortcuts Few People Know
Experienced Red Team professionals and Bug Bounty researchers use a combination of shortcuts and hidden features to multiply their analysis speed:
🔥 High-Speed Hotkeys (Mouse-Free Productivity):
Ctrl + TTurns Proxy interception on and off instantly (Toggle Intercept).
Ctrl + RCopies the request from Proxy and creates a new tab in Repeater.
Ctrl + Shift + RSwitches focus straight to the Repeater tab without touching the mouse.
Ctrl + '+' / '-'Switches between Repeater tabs without the risk of clicking the “X” and closing tabs.
Ctrl + U / Shift+UApplies instant URL-encode and URL-decode to the selected text.
Ctrl + B / Shift+BEncodes and decodes Base64 directly in the request body.
⚙️ 3 Hidden Tricks Few Analysts Use:
- Bypass with ‘Match and Replace’: In Proxy ➔ Options ➔ Match and Replace, you can create automated Regex rules to inject headers (such as
X-Forwarded-For: 127.0.0.1) or remove security headers (CSP/CORS) from every request leaving your machine, invisibly. - Session Keep-Alive with Null Payloads: To keep a logged-in session from expiring due to inactivity during the audit, send the keep-alive request to Intruder, select the payload type Null Payloads, check Continue indefinitely and set a 60-second interval.
- Reopen a Tab Closed by Mistake in Repeater: If you accidentally closed a Repeater tab with important notes and requests, just right-click the tab bar and select “Reopen Closed Tab” to recover it in full.
Setting Up the CA Certificate for HTTPS Interception
To intercept TLS-encrypted pages without constant untrusted-authority warnings (*SSL Error*), import the Burp Suite root certificate:
- Open the embedded browser via Proxy ➔ Open Browser (which already comes with the certificate transparently preinstalled).
- If you’re using the system’s default browser, point the HTTP/S proxy to
127.0.0.1on port8080. - Go to the local address
http://burpin the browser. - Click the CA Certificate button at the top to download the certificate
cacert.der. - In the browser, open the certificate settings and import the file, checking the option to trust this authority to identify websites.
Differences Between the Paid and Free Versions (Community vs. Professional)
Review the structural differences between the learning edition and the corporate suite used by cybersecurity consultancies:
| Feature / Capability | Community Edition (Free) | Professional Edition (Commercial) |
|---|---|---|
| Automated Burp Scanner | Not available | Active/passive vulnerability scanning (OWASP Top 10) |
| Intruder Speed | Artificially limited (deliberate *throttling*) | Full speed with no rate limiting |
| BApp Store Pro Extensions | Access to basic community plugins only | Full access to advanced extensions (e.g. Turbo Intruder) |
| Saving Projects to Disk | Temporary in-memory projects only | Projects saved to disk with full history and logs |
| Executive Report Generation | Manual | HTML/XML export for audits and compliance |
1. Automated Burp Scanner
Community Edition No automated scanner engine.
Professional Continuous scanning for critical OWASP Top 10 vulnerabilities.
2. Intruder Speed
Community Edition Speed deliberately reduced (throttled).
Professional High-speed multithreaded request firing.
3. Projects Saved to Disk
Community Edition Only volatile projects in temporary memory.
Professional Permanent storage of pentest history and sessions.
4. Executive Compliance Reports
Community Edition Requires manual documentation by the operator.
Professional Generation of structured technical and executive reports.
APPLICATION AND API AUDITS
Does Your Company Need a Professional Penetration Test (Pentest)?
Does Your Company Need a Professional Penetration Test (Pentest)?
The Alliances offensive security team audits web platforms, APIs and cloud architectures to identify logic flaws and gaps before cybercriminals find them.
🔗 Further Reading and References:
- See how to prepare your environment in the guide: Pen Test with Kali Linux and Parrot OS: A Complete Guide.
- Learn the fundamental reconnaissance commands in The 10 Most Used Nmap Commands for Beginners.
- Understand the contracting process in the Definitive Guide to Hiring a Corporate Pentest.
- Official documentation of the distributions: Official Kali Linux Portal and Official Parrot Security OS.
- Website of the tool’s creator: PortSwigger – Burp Suite.