Burp Suite: The Ultimate Web Security Testing Tool

Burp Suite, developed by PortSwigger, is the industry-standard integrated platform for web application security testing. It operates as an intercepting proxy that sits between the tester’s browser and the target web application, allowing every HTTP/S request and response to be captured, inspected, modified, and replayed. Burp Suite comes in three editions:

• Community Edition — free, includes the core proxy, Repeater, Intruder (rate-limited), Decoder, Comparer, and Sequencer.
• Professional Edition — paid, adds the automated vulnerability Scanner, unthrottled Intruder, Burp Collaborator client, and project-saving.
• Enterprise Edition — paid, CI/CD-integrated scanning at scale for organizations.

Kali Linux ships with Burp Suite Community Edition pre-installed. It is a Java-based application and is the primary tool used for manual web application penetration testing, covering the full OWASP Top 10 testing methodology including SQL injection, XSS, authentication flaws, business logic errors, and more.

How to Install

Burp Suite Community Edition is pre-installed on Kali Linux. To verify or reinstall:

# Check if already installed
which burpsuite

# Install/reinstall via apt
sudo apt update
sudo apt install burpsuite -y

# Verify Java dependency (Burp requires Java 17+)
java -version

To install the latest Professional or Community version manually from PortSwigger:

# Download the .sh installer from https://portswigger.net/burp/releases
chmod +x burpsuite_community_linux_v*.sh
sudo ./burpsuite_community_linux_v*.sh

Syntax

burpsuite [options]

Burp Suite is primarily a GUI tool; command-line flags mostly control startup behavior and headless operation (Professional only, for CI/CD scanning).

All Command-Line Options

Example with JVM memory tuning:

java -jar -Xmx4g /usr/share/burpsuite/burpsuite.jar

Basic Usage (Expected Output in Bash)

$ burpsuite

Expected terminal output:

Starting Burp Suite Community Edition v2024.x...
Loading extensions...
[+] Proxy listener started on 127.0.0.1:8080
[+] GUI initialized successfully

The GUI then opens, showing the Dashboard, Target, Proxy, Intruder, Repeater, Sequencer, Decoder, Comparer, and Extender tabs.

Practical Examples with Output

Example 1 — Launch Burp and confirm proxy listener

$ burpsuite &
$ curl -x http://127.0.0.1:8080 http: //testphp.vulnweb.com -I

Output:

HTTP /1.1 200 OK
Server: nginx /1.19.0
Content-Type: text/ html; charset=UTF-8

The request appears live in Burp’s Proxy > HTTP history tab.

Example 2 — Configure browser to use Burp proxy (Firefox, via CLI profile)

$ firefox -P burp-profile

Manually set Network Settings → Manual proxy → HTTP Proxy 127.0.0.1 Port 8080.

Example 3 — Export Burp’s CA certificate for HTTPS interception

$ curl -x http://127.0.0.1:8080 http:/ /burp/cert -o burp-cert.der
$ openssl x509 -inform DER -in burp-cert.der -out burp-cert.pem
$ file burp-cert.pem

Output:

burp-cert.pem: PEM certificate

Example 4 — Send a captured request to Repeater

Right-click a request in Proxy > HTTP history → Send to Repeater. In Repeater, click Send:

GE T /login .php HTTP/1.1
Host: testphp .vulnweb. com

Response pane shows:

HTTP /1.1 200 OK
Content-Length: 4321

Example 5 — Fuzz a parameter with Intruder (Sniper mode)

Set payload position: G ET /product.php?id=§1§ HTTP/1.1 Load a numeric payload list 1-100, start attack. Result grid shows status codes and response lengths per payload, e.g.:

Payload  Status  Length
1        200     4521
2        200     4521
13       500     3021   <- anomaly, possible SQLi

Example 6 — Use Decoder to URL-decode a captured parameter

Paste search=%3Cscript%3Ealert( 1)%3C%2Fscript into Decoder, select Decode as URL:

search=script alert(1)< script

Example 7 — Command-line headless scan (Professional only)

$ java -jar burpsuite_pro.jar --headless --project-file=scan.burp \
  --config-file=scan-config.json

Output:

[+] Loading configuration from scan-config.json
[+] Starting crawl and audit against target scope
[+] Scan completed: 14 issues found

Example 8 — Compare two responses with Comparer

Send two responses (before/after payload) to Comparer, click Words:

Differences highlighted: 3 words changed, 1 line added

Example 9 — Automate login session token analysis with Sequencer

Capture 200+ session tokens via Proxy, load into Sequencer, click Analyze Now:

Overall result: RANDOM (entropy: 128 bits/128 bits) — token generation appears secure

Common Use Cases

• Manual interception and modification of HTTP/S requests during authentication, authorization, and session-management testing.
• Fuzzing parameters for SQL injection, XSS, command injection, and IDOR using Intruder.
• Automated crawling and vulnerability scanning (Professional) as part of a full web app assessment.
• Analyzing session token randomness and predictability with Sequencer.
• Decoding/encoding payloads (Base64, URL, HTML, Hex) during exploit development.
• CI/CD-integrated DAST scanning using Burp Enterprise/Professional headless mode.

Automation with Bash

#!/bin/bash
# start-burp-and-proxy-test.sh — launch Burp headlessly and validate proxy availability

BURP_JAR="/usr/share/burpsuite/burpsuite.jar"
PROXY="127.0.0.1:8080"

java -jar "$BURP_JAR" &
BURP_PID=$!

echo "[*] Waiting for Burp proxy to come up..."
for i in {1..15}; do
    if curl -s -x "http://$ PROXY" http://example.com -o /dev/null; then
        echo "[+] Burp proxy is live on $PROXY"
        break
    fi
    sleep 2
done

# Route a target list through Burp for passive capture
while read -r url; do
    curl -s -x "http://$PROXY" -o /dev/null "$url"
    echo "[+] Sent through proxy: $url"
done < targets.txt

echo "[*] Burp PID: $BURP_PID — check Proxy > HTTP history for captured traffic"

Tips and Best Practices

• Always scope your Target before running active scans to avoid attacking out-of-scope hosts.
• Install Burp’s CA certificate in your browser/OS trust store to intercept HTTPS cleanly without warnings.
• Use Match and Replace rules to automatically strip cache-busting headers or inject auth tokens.
• Save projects regularly (--project-file) during long engagements to avoid losing captured data.
• Combine Burp with a browser extension like FoxyProxy for fast proxy toggling.
• Use Burp Collaborator to detect out-of-band (blind) vulnerabilities such as blind SSRF and blind XXE.

Troubleshooting

References

• Official documentation: https://portswigger.net/burp/documentation
• PortSwigger Web Security Academy: https://portswigger.net/web-security
• Kali Linux tool page: https://www.kali.org/tools/burpsuite/
• Release downloads: https://portswigger.net/burp/releases