Burp Suite Fundamentals
Part of the Cybersecurity Roadmap
In short
Burp Suite sits between your browser and a web app, letting you see and study the HTTP traffic. For authorised testers and developers alike, it makes a web app's inner workings visible.
The standard tool for web application security testing — intercepting and modifying HTTP requests, scanning for vulnerabilities, and testing input validation manually.
Think of it like this
A glass pipe on the water line
A plumber fits a clear section of pipe to watch exactly what flows through. Burp is a glass pipe on your web traffic: every request and response becomes visible, so you can study how the app behaves and where it trusts input it should not.
Watch it happen
How a proxy reveals a request
POST /login
1/4The browser sends a request, which passes through the local proxy you configured.
The big ideas
What you need to know
See the real traffic
A proxy shows the exact HTTP under the pretty UI, including headers and cookies the browser hides.
Spot trust mistakes
You can see where an app relies on client side checks it should enforce on the server instead.
Great for developers
Devs use Burp to debug their own apps and confirm security headers and input handling actually work.
Your app or scope only
Intercepting traffic to a site you do not own or control is off limits. Use it on your own apps and labs.
Save yourself the pain
Common mistakes
Oops
Intercepting and tampering with websites you do not own.
Do this instead
Use a proxy only on your own apps or an authorised scope. Messing with others' sites is illegal.
Oops
Trusting client side validation because it looks solid in the browser.
Do this instead
Burp shows you can change any request. Always enforce validation and authorisation on the server.
Your mission
Proxy your own app
Quick check
What does Burp Suite let you do as an intercepting proxy?
Go deeper
- 1Set up Burp Suite as a proxy and intercept traffic from a browser to a practice web app.
- 2Practice modifying a request in Burp's repeater tool and observing the server's response.
- 3Learn the difference between Burp's manual testing tools and its automated scanner.
More topics at this stop
Penetration Testing Methodology
Reconnaissance & OSINT
Scanning & Enumeration (Nmap)
Exploitation Basics
Metasploit Framework
Privilege Escalation
Post-Exploitation Basics
Password Attacks & Cracking
Wireless Security Testing (Overview)
Report Writing for Pentests
Stuck on this topic? Ask an Insider
Get 1:1 guidance from people who've walked this exact path — on the InsideEdge app.
