Burp Suite Lab — Hacky CTF | The Gold Standard in Web App Pentesting

What is Burp Suite?

Tool overview and real-world usage

Burp Suite is an integrated platform for performing web application security testing. It contains a range of tools including an intercepting proxy, scanner, intruder, repeater, and sequencer — all designed to work together seamlessly.

Burp Suite is used by penetration testers, SOC analysts, red teams, and security researchers worldwide. It is a core tool requirement for certifications including CEH · OSCP · PNPT · eJPT.

Setting up browser proxy with FoxyProxy

Intercepting and modifying HTTP requests

Using Repeater to test injection points

Intruder for fuzzing and brute forcing

Discovering IDOR and authentication bypass

Testing OWASP Top 10 vulnerabilities

Step-by-Step Commands

Follow each step in order

01

Setup Proxy

Configure browser to route traffic through Burp on port 8080

bash

Proxy → Options → Listen on 127.0.0.1:8080 → Install CA Certificate

Install Burp's CA certificate in your browser to intercept HTTPS. In Firefox: Preferences → Certificates → Import → Select cacert.der from Burp.

02

Intercept Request

Capture a login request to analyze parameters

bash

Proxy → Intercept → Turn Intercept ON → Submit form in browser

Every HTTP request now pauses in Burp. You can read, modify, or drop it. Forward sends it to the server. Look for hidden parameters, JWT tokens, and cookies.

03

Send to Repeater

Manually test SQL injection on a parameter

bash

Right-click request → Send to Repeater → Ctrl+R → Modify and Resend

Repeater lets you manually craft and resend requests as many times as needed. Change parameter values one at a time to test for injection. Essential for manual testing.

04

Intruder Attack

Brute force a login form

bash

Send to Intruder → Positions → Add markers around password → Payloads → Load wordlist → Start Attack

Intruder automates customized attacks. Sniper mode tests one payload position. Cluster Bomb tests multiple positions simultaneously. Use with rockyou.txt or custom wordlists.

05

Active Scan (Pro)

Automatically discover vulnerabilities

bash

Right-click target → Scan → Select scan type → Review findings

Pro version only. Automatically finds SQLi, XSS, SSRF, XXE, and hundreds more. Community Edition users can use Burp extensions and manual testing instead.

Lab Hints

Click to reveal hints one at a time

Hint 1►

Always work in an authorized environment. Never use Burp Suite on networks or systems you do not have explicit written permission to test.

Hint 2►

Save all your output and notes as you go. Penetration test reports require evidence — screenshots, command output, and timestamps. Use tee or output redirection to capture everything.

Hint 3►

If something fails, check your network connectivity first. Then verify you have the correct target IP. Then check if a firewall or IDS is blocking your attempts.

Hint 4►

Practice on intentionally vulnerable machines: TryHackMe, HackTheBox, VulnHub, or DVWA. These are legal targets designed for learning. Never practice on real targets without permission.

Live Threat Intelligence

Lookup any IP or CVE from your findings

GeoIP Lookup

Enter a target IP to geolocate.

CVE Lookup

Try: CVE-2021-44228 (Log4Shell)

Lab Solution

Attempt the lab first before revealing

Burp Suite — The Gold Standard in Web App Pentesting

Related Labs