Introduction to Burp Suite
You install Burp Suite Community, intercept browser traffic, replay and decode requests, all against your own lab app.
Level 101 · 15 lessons · 12 practice labs
Lessons
Setup
- What an intercepting proxy is and why testers and developers use it
- Installing Burp and safely adding its CA certificate to the browser
- The embedded browser and configuring an external one
- Projects, target scope and hiding out-of-scope traffic
- Short task: put the lab app in scope and filter everything else
Seeing the traffic
- The Proxy tab: catch, change and forward a request
- HTTP history: filtering, searching, adding comments and colours
- The Target site map: the skeleton of the application
- Hidden fields and why client-side validation is not enough
- Short task: find the request that skips the client-side price check and propose a server-side fix
Core tools
- Repeater: changing a request and sending it again and again
- Decoder and Comparer: decoding data and comparing responses
- Introduction to Intruder: positions and simple payload lists
- Noting findings and exporting them as evidence
- Capstone: recognise and evidence three flaws in the lab app with Burp
Practice labs
- Silence the noise: only the lab app: Put the lab app in scope in the browser traffic, hide other domains and show only target requests remain in HTTP history.
- A forgotten page in the site map: Find the page that appears in the site map while browsing but has no menu link and write a recommendation to close it.
- Mark the requests carrying passwords in HTTP history: Filter HTTP history to find every request carrying a password or token, colour them and report which ones carry it in the URL.
- Separate API and static files with scope rules: Separate API requests from static files with advanced scope rules, list only state-changing requests and set testing priority.
- The server does not check the hidden price field: Intercept and change the hidden price field in the basket form, prove the server accepts it and propose a fix that calculates the price server-side.
- The request behind a button disabled in the client: Capture and send the request behind a delete action disabled in the UI, prove the server skips the authorisation check and add it.
- A client-side length limit: Bypass the username field's client-side limit at the proxy, show the server accepts long input and add server-side validation.
- Unlocking a hidden menu by modifying the response: Test whether the requests behind the admin menu that appears when you change the role in the response are protected server-side and close the one left open.
- Decode the Base64 role in the cookie: Decode a Base64-encoded role in a cookie with Decoder, show in Repeater that it can be changed and propose a signed-session fix.
- Compare two responses: does the user exist: Compare login responses for an existing and a missing user with Comparer, find the revealing difference and make the responses identical.
- Measure the coupon code limit with Intruder: Send a short payload list to the coupon check endpoint to prove there is no attempt limit, add rate limiting and measure again.
- Three finding notes with Burp evidence: Export request-response evidence for three flaws you found in the lab app, redact secrets and write a short finding note for each.
About this course
You install Burp Suite Community, intercept browser traffic, replay and decode requests, all against your own lab app.
What you will learn
- Setup
- Seeing the traffic
- Core tools
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.