# Burp Suite

> Intercept, inspect & manipulate HTTP/HTTPS traffic using Burp Suite's proxy, scanner & repeater for web app enumeration and vulnerability discovery.

- **URL:** https://hackindex.io/services/web/enumeration/burp-suite
- **Path:** HTTP/HTTPS > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/web/enumeration.md)
- **Published:** 2026-09-14
- **Updated:** 2026-09-14

Burp Suite is the primary tool for intercepting and manipulating HTTP traffic during a web application assessment. It acts as a proxy between your browser and the target, letting you inspect, modify, and replay every request. The Community Edition covers the core workflow: Proxy, Repeater, Intruder, Decoder, and Comparer. The Professional Edition adds an active scanner, but the manual workflow below works for all assessments including OSWA.

## Proxy Setup

Burp listens on `127.0.0.1:8080` by default. Point your browser or tool to that address to intercept traffic.

**Route curl through Burp proxy**

```bash
curl -sk --proxy http://127.0.0.1:8080 "http://$TARGET_IP:$PORT/"
```

To intercept browser traffic: open Burp, go to **Proxy > Options**, confirm the listener is on port 8080, then configure the browser's proxy settings to `127.0.0.1:8080`. Firefox with FoxyProxy or the Burp built-in browser is the simplest setup. Install the Burp CA certificate (`http://burpsuite` while proxy is active) to intercept HTTPS without TLS warnings.

## Intercept Tab

When **Intercept is on**, each request pauses before it reaches the server. You can view the raw request, edit any field (headers, parameters, body), and then forward it. This is the core manipulation workflow.

- **Forward**: send the request as-is (or after edits).
- **Drop**: discard the request without sending it.
- **Action > Send to Repeater**: copy the request to Repeater for repeated manual testing.
- **Action > Send to Intruder**: copy to Intruder for automated payload injection.

Turn intercept off when browsing normally to avoid manually forwarding every request. Turn it back on when you want to catch a specific action.

## HTTP History

**Proxy > HTTP History** shows every request that passed through the proxy, even when intercept was off. Use this to review the full session after exploring a feature. Filter by host, response code, or content type. Right-click any request to send it to Repeater or Intruder for further testing.

## Repeater

Repeater lets you manually resend a request as many times as needed with arbitrary modifications. It is the primary tool for manual vulnerability testing.

1. Capture a request in Proxy or right-click a history entry and select **Send to Repeater**.
2. In the Repeater tab, modify headers, parameters, or the body.
3. Click **Send**. The response appears on the right.
4. Use the **Inspector** panel to see parsed query parameters, headers, and cookies without editing raw text.

## Intruder

Intruder automates sending a request with a payload list substituted at marked positions. Use it for fuzzing parameters, brute-forcing login forms, and testing injection points at scale. The Community Edition rate-limits Intruder. For fast fuzzing, use [wfuzz or ffuf](https://hackindex.io/services/web/enumeration/content-discovery) instead.

### Attack Types

- **Sniper**: one payload list, one position at a time. Good for testing a single parameter.
- **Battering ram**: one payload list, same payload in all positions simultaneously. Good for username = password scenarios.
- **Pitchfork**: multiple payload lists, one per position, iterated in parallel. Good for username + password pairs.
- **Cluster bomb**: multiple payload lists, all combinations. Good for brute-force where you need every combination of username and password.

### Marking Positions

In Intruder, the **Positions** tab shows the raw request. Click **Clear §** to remove auto-detected positions, then highlight the value you want to fuzz and click **Add §**. The markers `§value§` define where payloads are inserted.

## Decoder

Decoder encodes and decodes values without leaving Burp. Paste a value and apply transformations in sequence.

- **Decode as URL**: convert `%2F` to `/`.
- **Encode as Base64**: convert to base64 for JWT or cookie manipulation.
- **Decode as HTML**: convert HTML entities like `&` to `&`.
- **Smart decode**: attempts to detect and decode the encoding automatically.

Decoder is also useful when crafting payloads: encode your payload to the format the application expects, then paste the encoded value into Repeater or Intruder.

## Comparer

Comparer shows a diff between two requests or responses. Send two items from Proxy history or Repeater using **Send to Comparer**, then click **Compare** to highlight differences. Useful for comparing authenticated vs unauthenticated responses to detect access control differences, or comparing responses with and without a CSRF token to see if the token is actually validated.

## Useful Shortcuts

- **Ctrl+R**: Send to Repeater
- **Ctrl+I**: Send to Intruder
- **Ctrl+U**: URL-encode selection (in Repeater)
- **Ctrl+Shift+U**: URL-decode selection (in Repeater)
- **Ctrl+F**: Forward intercepted request
- **Ctrl+T**: Toggle intercept on/off (in Proxy tab)
- **Ctrl+Shift+Tab**: Switch to next Repeater tab

## References

- [PortSwigger: Getting Started with Burp Suite](https://portswigger.net/burp/documentation/desktop/getting-started) - Official docs covering setup, CA certificate installation, and core tools.
- [PortSwigger: Repeater](https://portswigger.net/burp/documentation/desktop/tools/repeater) - Detailed Repeater usage including the Inspector panel.
- [PortSwigger: Intruder Attack Types](https://portswigger.net/burp/documentation/desktop/tools/intruder/attack-types) - Sniper, Battering Ram, Pitchfork, Cluster Bomb explained with examples.