What Is Burp Suite and How Is It Used for Web Application Security Testing?

Key takeaways

• Burp Suite is a proxy first. Learn Proxy, Target and Repeater before anything else, because most real testing happens there.
• The free Community Edition is enough to learn. Professional adds the automated scanner, an unthrottled Intruder and extras.
• Practise on legal targets: PortSwigger's free Web Security Academy labs, DVWA or your own VM. Testing a live site without written permission is an offence under India's IT Act, 2000.
• A scanner finding is a lead, not a verdict. You confirm each one by hand and report the fix as well as the flaw.

What is Burp Suite?

Burp Suite is made by PortSwigger and is the most widely used tool for hands-on web application testing. Browsers hide what they send to a server. Burp makes that traffic visible and editable, which is how testers find flaws in how an application handles input, sessions and permissions. Official documentation is at portswigger.net/burp/documentation.

Editions

Editions and prices change, so check PortSwigger's site for the current line-up.

What are the main tools and what is each for?

• Proxy: intercepts requests and responses. You can pause, edit and forward them, and review the history afterwards.
• Target (site map): builds a tree of the hosts, paths and parameters you have visited. Set scope here so Burp ignores everything else.
• Crawler: in current versions, the crawler replaced the old Spider for mapping an application automatically.
• Repeater: resend one request again and again with small changes. This is the tool you will use most.
• Intruder: send many variations of a request, marking positions where payloads go. Useful for testing how an application reacts to many inputs, such as rate-limit checks on your own lab.
• Scanner (Pro): automated checks for common weaknesses. Fast, but it needs a human to verify and to explain business impact.
• Sequencer: tests how random session tokens are.
• Decoder: converts between URL, Base64, hex and other encodings.
• Comparer: highlights differences between two responses.
• Extensions (BApp Store): add features such as Autorize for access-control testing and Logger++ for traffic logging.

Setting it up

1. Download Burp from PortSwigger and run it. Choose a temporary project to begin with.
2. The easiest route is Burp's built-in browser, opened from the Proxy tab. It is already configured, including HTTPS.
3. To use your own browser instead, point it at the proxy listener, 127.0.0.1:8080 by default, and install Burp's CA certificate so HTTPS traffic can be inspected. You can download it by browsing to http://burp while proxied.
4. Set the scope to your lab target only.
5. Turn Intercept on, load a page, and watch the request appear. Forward it, then turn intercept off and browse normally. The history keeps everything.

Remove the Burp CA certificate from your browser when you finish with a lab, because anyone holding its private key could intercept your traffic.

A first exercise in a lab

PortSwigger's Web Security Academy offers free, legal labs. As a first exercise, take any lab with a login or shopping function.

1. Log in with the lab's own test account while Burp proxies the traffic.
2. Find the login request in Proxy history and send it to Repeater.
3. Change one thing at a time, such as a parameter value or a header, and watch how the response changes.
4. Record what the server trusts that it should not. That habit, noticing what the client controls, is the core skill.

What Burp helps you find, and how to fix it

These and others appear in the OWASP Top 10, which is the usual checklist for web testing. The OWASP Cheat Sheet Series gives the matching defences.

Good habits

• Set scope before you start, and never test outside it.
• Use two accounts to test access control. One account only shows you your own data.
• Take notes as you go: request, change, response, impact.
• Do not trust scanner severity. Confirm, then rate by business impact.
• Use throttling on any real engagement so you do not knock over the application.

How does Burp Suite help with bug bounty, OSCP and careers?

Bug bounty hunters use Burp to map applications and test authentication, APIs and file uploads, within each programme's written rules. Web content in the OSCP exam is tested in the lab environment, and OffSec's rules on what tools may be used on the exam are published in its exam guide, so check them before test day. For a web-focused path, OffSec's WEB-200 is the course for web assessments. Roles that value Burp skills include web application tester, application security engineer and bug bounty researcher.

Legal reminder

Only test what you own or have written permission to test. Bug bounty programmes define scope and rules, and anything outside them is unauthorised. See our Burp Suite overview and top web penetration testing tools for more on tool choices.

Next steps

For guided practice, the Web Application Penetration Testing (WAPT) course teaches Burp inside a structured methodology, and the OSWA (WEB-200) course covers the OffSec web path.

Related reading

• How I Found My First Bug | A Beginner’s Step-by-Step Journey into Bug Bounty Hunting in 2026
• Discovering SQLi Vulnerabilities | Step-by-Step Guide to Intercept and Exploit User Inputs