Burp Suite Community Edition: Complete Guide

Getting Started

1. Visit PortSwigger's download page
2. Download the appropriate version for your operating system
3. Run the installer and follow the installation wizard
4. Launch Burp Suite Community Edition

Proxy Configuration Steps

1. Navigate to Proxy > Options
2. Default proxy listener runs on 127.0.0.1:8080
3. Install Burp's CA certificate in your browser:
   • Visit http://burp
   • Download the CA certificate
   • Import into browser's certificate store
4. Configure browser to use Burp's proxy:
   • Set HTTP/HTTPS proxy to 127.0.0.1:8080
   • Use browser extensions like FoxyProxy for easy switching

Intercepting Traffic

• Enable/disable interception using the "Intercept" button
• View and modify requests/responses in real-time
• Forward, drop, or modify intercepted traffic
• Use filters to focus on specific traffic:

  Host: example.com
  Method: POST
  URL: /api/.*

Site Mapping

• View site map of all discovered content
• Set target scope to focus testing
• Analyze attack surface
• Filter and organize targets

Request Manipulation

• Modify and resend requests
• Test different parameters and payloads
• Compare responses
• Useful keyboard shortcuts:

  Ctrl+R: Send request
  Ctrl+U: URL encode
  Ctrl+Shift+U: URL decode

Automated Testing

Four attack types:

1. Sniper: Tests one payload set against single position
2. Battering Ram: Uses same payload in multiple positions
3. Pitchfork: Uses multiple payload sets simultaneously
4. Cluster Bomb: Tests all combinations of payload sets

Encoding/Decoding

• URL encoding/decoding
• Base64 encoding/decoding
• HTML encoding/decoding
• ASCII hex encoding/decoding
• Multiple encoding layers support

Optimization Tips

1. Use scope settings to reduce noise:
   • Define target scope
   • Filter proxy history
   • Configure target scope settings
2. Save important requests to repeater
3. Use project files to save work
4. Configure display filters effectively
5. Master keyboard shortcuts for efficiency

Security Testing Workflows

1. Authentication Testing:
   • Capture login requests
   • Test session handling
   • Check password reset functionality
2. Authorization Testing:
   • Test access controls
   • Check role-based permissions
   • Verify API endpoints
3. Input Validation:
   • Test for XSS vulnerabilities
   • Check SQL injection points
   • Verify file upload security