Burp Suite

Burp Suite is the primary tool for intercepting and manipulating HTTP traffic during a web application assessment. It acts as a proxy between your browser and the target, letting you inspect, modify, and replay every request. The Community Edition covers the core workflow: Proxy, Repeater, Intruder, Decoder, and Comparer. The Professional Edition adds an active scanner, but the manual workflow below works for all assessments including OSWA.

Proxy Setup

Burp listens on 127.0.0.1:8080 by default. Point your browser or tool to that address to intercept traffic.

To intercept browser traffic: open Burp, go to Proxy > Options, confirm the listener is on port 8080, then configure the browser's proxy settings to 127.0.0.1:8080. Firefox with FoxyProxy or the Burp built-in browser is the simplest setup. Install the Burp CA certificate (http://burpsuite while proxy is active) to intercept HTTPS without TLS warnings.

Intercept Tab

When Intercept is on, each request pauses before it reaches the server. You can view the raw request, edit any field (headers, parameters, body), and then forward it. This is the core manipulation workflow.

• Forward: send the request as-is (or after edits).

• Drop: discard the request without sending it.

• Action > Send to Repeater: copy the request to Repeater for repeated manual testing.

• Action > Send to Intruder: copy to Intruder for automated payload injection.

Turn intercept off when browsing normally to avoid manually forwarding every request. Turn it back on when you want to catch a specific action.

HTTP History

Proxy > HTTP History shows every request that passed through the proxy, even when intercept was off. Use this to review the full session after exploring a feature. Filter by host, response code, or content type. Right-click any request to send it to Repeater or Intruder for further testing.

Repeater

Repeater lets you manually resend a request as many times as needed with arbitrary modifications. It is the primary tool for manual vulnerability testing.

1. Capture a request in Proxy or right-click a history entry and select Send to Repeater.

2. In the Repeater tab, modify headers, parameters, or the body.

3. Click Send. The response appears on the right.

4. Use the Inspector panel to see parsed query parameters, headers, and cookies without editing raw text.

Intruder

Intruder automates sending a request with a payload list substituted at marked positions. Use it for fuzzing parameters, brute-forcing login forms, and testing injection points at scale. The Community Edition rate-limits Intruder. For fast fuzzing, use wfuzz or ffuf instead.

Attack Types

• Sniper: one payload list, one position at a time. Good for testing a single parameter.

• Battering ram: one payload list, same payload in all positions simultaneously. Good for username = password scenarios.

• Pitchfork: multiple payload lists, one per position, iterated in parallel. Good for username + password pairs.

• Cluster bomb: multiple payload lists, all combinations. Good for brute-force where you need every combination of username and password.

Marking Positions

In Intruder, the Positions tab shows the raw request. Click Clear § to remove auto-detected positions, then highlight the value you want to fuzz and click Add §. The markers §value§ define where payloads are inserted.

Decoder

Decoder encodes and decodes values without leaving Burp. Paste a value and apply transformations in sequence.

• Decode as URL: convert %2F to /.

• Encode as Base64: convert to base64 for JWT or cookie manipulation.

• Decode as HTML: convert HTML entities like & to &.

• Smart decode: attempts to detect and decode the encoding automatically.

Decoder is also useful when crafting payloads: encode your payload to the format the application expects, then paste the encoded value into Repeater or Intruder.

Comparer

Comparer shows a diff between two requests or responses. Send two items from Proxy history or Repeater using Send to Comparer, then click Compare to highlight differences. Useful for comparing authenticated vs unauthenticated responses to detect access control differences, or comparing responses with and without a CSRF token to see if the token is actually validated.

Useful Shortcuts

• Ctrl+R: Send to Repeater

• Ctrl+I: Send to Intruder

• Ctrl+U: URL-encode selection (in Repeater)

• Ctrl+Shift+U: URL-decode selection (in Repeater)

• Ctrl+F: Forward intercepted request

• Ctrl+T: Toggle intercept on/off (in Proxy tab)

• Ctrl+Shift+Tab: Switch to next Repeater tab