If Nmap and Wireshark are the go-to tools for seeing traffic at the network layer, Burp Suite plays the same role at the web application layer. Built by PortSwigger, it's the industry standard for web application penetration testing and shows up somewhere in the workflow of nearly every professional web pentest engagement. Its Community edition is free and more than enough to learn with.
Important: every test in this tutorial should only be run against applications you have explicit authorization to test. For safe practice, either use a local lab environment like DVWA (Damn Vulnerable Web Application) on your own virtual machine, or use official sites built for security practice, like testphp.vulnweb.com, made publicly available by Acunetix for exactly this purpose. Intercepting traffic on any other site without permission is illegal.
How does Burp Suite actually work?
The core idea is simple: Burp sits as a proxy between your browser and the target server. Every request your browser sends passes through Burp first, where you can view it, pause it, modify it, or resend it — before it ever reaches the server.
Step 1: Install and launch
The Community edition can be downloaded from PortSwigger's site, and it's already installed on Kali Linux:
burpsuite
After launching, create a Temporary Project and click "Start Burp."
Step 2: Configure your browser's proxy
You need to configure your browser so its traffic passes through Burp. The easiest way is the FoxyProxy extension, or manually setting your browser's proxy to:
127.0.0.1:8080
This is the address and port Burp listens on by default (viewable and changeable under Proxy > Options).
Step 3: Install the CA certificate for HTTPS
Since most modern sites use HTTPS, for Burp to read encrypted traffic too, you need to install its dedicated CA certificate in your browser. With your browser set to Burp's proxy, navigate to:
http://burp
and download the certificate, then add it to your browser as a trusted authority.
Step 4: Intercept your first request
In the Proxy tab, open the Intercept sub-tab and make sure "Intercept is on." Now open a page from the lab site in your browser — the HTTP request stops right there, in Burp, before it ever reaches the server. You can see the full headers, cookies, and request body, and modify them if needed, before clicking "Forward."
Step 5: Send to Repeater for manual testing
Right-click the intercepted request and choose "Send to Repeater." In the Repeater tab, you can resend that same request repeatedly with different values (e.g., changing a parameter in the URL or POST body) and see the server's response each time — exactly what's needed to manually test a parameter you suspect is vulnerable.
Step 6: Review the full history with HTTP History
Even with Intercept turned off, Burp still logs all traffic under Proxy > HTTP History — a complete list of every request and response exchanged while browsing the lab site, for later review.
Summary
Burp Suite isn't just a tool for "seeing" traffic — nearly every more advanced web pentesting technique, from manually finding SQL Injection to testing an application's business logic, starts from this same basic interception workflow. In my web security courses, once this basic workflow is mastered, we move into automation and more advanced scanning techniques.
Blog