Skip to content

Burp Suite installation and basics (WA101)

Prerequisites

  • Set up the local Docker lab container (or another deliberately vulnerable web target on localhost).
  • Burp Suite Community Edition is sufficient for this course (free).
  • A Chromium-based browser or Firefox for proxy configuration.
  • Lab use only — proxy systems you own or explicit lab targets.

Overview

Burp Suite sits between your browser and the web application. You browse normally; Burp captures every request and response so you can inspect, replay, and modify traffic to find vulnerabilities.

This guide covers installation and the features you will use most often for the six WA101 web attacks.

Attack Burp tools you will use most
SQLi Proxy, Repeater, Intruder (optional)
XSS Proxy, Repeater, Response inspection
IDOR Proxy, Repeater (change IDs in path/body)
CSRF Proxy, Repeater, Compare site map
SSRF Repeater (change URL parameters)
Command injection Repeater, Intruder (careful in lab only)

Step 1 — Install Burp Suite Community

  1. Download Burp Suite Community Edition from PortSwigger.
  2. Run the installer (Windows/macOS) or unpack the Linux archive per vendor instructions.
  3. Launch Burp Suite Community.
  4. On first start, choose Temporary project (or create a named project if you prefer).
  5. Select Use Burp defaults unless your course specifies otherwise → Start Burp.

👉 Community Edition has rate limits on Intruder and no built-in scanner — enough for hands-on WA101 labs.

Step 2 — Configure your browser proxy

Burp’s default listener:

Setting Value
Host 127.0.0.1
Port 8080

No port conflict: The WA101 INSECURE Docker lab uses host port 8081, so Burp’s default listener on 8080 works without changes. If another tool already occupies 8080, move Burp to 8888 in Proxy → Proxy settings.

Burp’s embedded browser (easiest)

  1. Proxy → Intercept → Open Browser.
  2. Burp launches a preconfigured Chromium window — traffic is proxied automatically.

System browser (manual)

Point the browser HTTP/HTTPS proxy to 127.0.0.1 and your Burp port (default 8080).

For HTTPS sites, install Burp’s CA certificate:

  1. With proxy on, visit http://burp or use Burp’s CA certificate export (Proxy → Proxy settings → Import / export CA certificate).
  2. Install as a trusted root CA in your OS or browser (lab machine only).

Step 3 — Confirm traffic is flowing

  1. Ensure Intercept is off (Proxy → Intercept → Intercept off) so browsing is not paused on every request.
  2. Browse to your lab app, e.g. http://localhost:8081 (dashboard) or the vulnerable lab URL from your exercise.
  3. Open Burp Proxy → HTTP history — you should see GET/POST lines appear.

If nothing appears, check proxy port, browser settings, and that nothing else blocks 127.0.0.1.

Core Burp features (WA101)

Proxy — HTTP history

What it does: Logs all proxied requests and responses.

How you use it:

  • Click a row to view raw request/response.
  • Find forms, APIs, cookies, and parameters to test.
  • Right-click → Send to Repeater for manual payload tests.

Attack hunting tips:

  • SQLi / command injection: Look for query parameters, JSON fields, and cookies passed to backend logic.
  • XSS: Find parameters echoed in HTML responses.
  • IDOR: Note numeric or UUID paths (/api/orders/1042).
  • CSRF: Find state-changing POST requests that rely only on session cookies.
  • SSRF: Find parameters like url=, src=, callback=, fetch=.

Intercept

What it does: Pauses each request (or response) so you can edit before it continues.

How you use it:

  1. Turn Intercept on.
  2. Submit a form in the browser.
  3. Edit the raw request in Burp (e.g. change id=5 to id=6).
  4. Click Forward.

Use Intercept sparingly at first — Repeater is often clearer for learning.

Repeater

What it does: Sends a single request again and again with edits you control.

How you use it:

  1. From HTTP history, right-click a request → Send to Repeater.
  2. Modify the request line, headers, or body.
  3. Click Send and read the response.

Target — Site map

What it does: Builds a tree of hosts, directories, and endpoints Burp has seen.

How you use it:

  • Crawl the lab app while proxied.
  • Expand branches to find hidden paths or API routes.
  • Right-click items → Send to Repeater.

Useful for IDOR and CSRF discovery when the app has many routes.

Decoder

What it does: Encodes/decodes Base64, URL encoding, hashes, etc.

How you use it:

  • Decode cookies or tokens copied from requests.
  • URL-encode XSS payloads before pasting into Repeater.

Intruder (Community — limited)

What it does: Automates many requests with a payload list (fuzzing).

How you use it (high level):

  1. Send a request to Intruder.
  2. Mark insertion points on parameters.
  3. Add a simple payload list (numbers, common SQLi strings).
  4. Start attack; compare responses (length, status code, errors).

Use only on lab targets. Community Edition is throttled — small wordlists are fine for learning.

Suggested workflow per WA101 attack

  1. Read the attack guide in the hosted WA101 docs (docs/docs/wa101/attacks/ in the course repo).
  2. Browse the vulnerable feature with Burp proxy on and Intercept off.
  3. Pick interesting requests from HTTP history → Repeater.
  4. Test one vulnerability hypothesis at a time; save request/response snippets.
  5. Record steps, payloads, and remediation in your lab notes or report.

Safety and scope

  • Use Burp only against local Docker labs or hosts you are authorized to test.
  • Do not point Burp at third-party sites without permission.
  • Disable the Burp CA certificate or remove it from your trust store when finished on a shared machine.

Troubleshooting

Issue Fix
HTTPS certificate errors Install Burp CA in browser/OS, or test over plain HTTP on localhost
No requests in history Verify proxy port; try Burp’s Open Browser
Dashboard unreachable Check Docker is up; browse http://localhost:8081 (not 8080 — that is Burp’s proxy port)
Intercept “stuck” Click Forward or turn Intercept off
Community Intruder slow Use smaller payload lists; prefer Repeater for learning