How to Use Burp Suite: Practical Beginner Guide

In one line

Burp Suite sits between your browser and a website so you can see every request, pause it, change it, and resend it, which is how web hackers poke at an app.

What this is, for a beginner

Burp Suite is the tool most web application testers reach for, because it turns your browser into something you fully control. It works as an intercepting proxy: every request your browser makes passes through Burp, where you can read it, pause it, modify it, and forward it. That visibility and control is the foundation of nearly every web attack technique.

The parts you will use first are the Proxy (to capture and intercept traffic), Repeater (to send a single request repeatedly with tweaks), and Intruder (to automate sending many variations, for example a wordlist). Learn these three and you can perform most of the manual testing in the vulnerability walkthroughs on this site.

The legal lab we use: OWASP Juice Shop or DVWA

Point Burp at your own local Juice Shop or DVWA. Only ever intercept and modify traffic to applications you own or are authorized to test.

OWASP Juice Shop or DVWA project page →

Full walkthrough: exploiting it step by step

Step 1 — Start Burp and its browser

Open Burp Suite (the free Community Edition is enough to learn) and use its built-in browser via Proxy then Open Browser, which is pre-configured to route through Burp.

Expected result: Burp's browser opens and any site you visit through it appears in Proxy then HTTP history.

Step 2 — Browse the target and read history

Navigate your local lab (Juice Shop or DVWA) through Burp's browser and watch requests populate the HTTP history. This is how you learn what the app sends.

Expected result: A running list of requests and responses for the app appears in HTTP history, ready to inspect.

Step 3 — Intercept and modify a request

Turn on Proxy then Intercept, perform an action in the app, and Burp pauses the request. Change a value, then forward it, to see how the server reacts to input the app never intended to send.

Proxy → Intercept

Intercept ON → edit a parameter → Forward

Expected result: The modified request reaches the server, and you observe the response change, proving you control what is sent, not just what the UI allows.

Step 4 — Use Repeater to iterate

Right-click a request and Send to Repeater. There you can resend it repeatedly, changing one thing each time, which is ideal for testing injection or access-control payloads by hand.

Repeater

Right-click → Send to Repeater → edit → Send

Expected result: You can fire the same request many times with different values and compare responses side by side, the core loop of manual testing.

Step 5 — Automate with Intruder

Send a request to Intruder, mark a payload position, load a wordlist, and run it to automate many variations, such as brute forcing a parameter or fuzzing an input.

Intruder

Send to Intruder → set §position§ → load list → Start attack

Expected result: Intruder sends one request per payload and tabulates the responses, so anomalies (by length or status) stand out for you to investigate.

Free resource

Get the free 35-week ethical hacking roadmap

The exact order I'd learn this in, every vulnerability and tool, week by week, with the labs to practise each one. Enter your email and I'll send it over, plus one practical lesson each week.

How to detect and fix this

How to detect it

From a defender's side, proxy-driven tampering produces requests that deviate from what the UI would send; server-side validation and logging of anomalous inputs help catch it.
Repeated, patterned requests characteristic of Intruder can be spotted by rate limiting and anomaly detection.
The real lesson for defenders is that anything enforced only in the browser is invisible to Burp users, so enforce on the server.

How to fix it

Never trust the client: validate and authorise every request server-side, because Burp lets an attacker send anything regardless of your UI.
Apply rate limiting to blunt automated tools like Intruder against sensitive endpoints.
Log and monitor for anomalous requests and parameter values that a normal client would never produce.
Use anti-automation controls where appropriate, understanding they raise the bar rather than stop a determined tester.

Common beginner mistakes

Forgetting to configure the browser or use Burp's browser, so no traffic appears in history.
Leaving Intercept on and getting confused when the browser hangs; turn it off when you just want to browse.
Jumping to Intruder before understanding a request in Repeater, which wastes time on noisy attacks.
Pointing Burp at sites you do not own; only intercept traffic to your own labs or authorized targets.

FAQ

Is the free Community Edition of Burp enough to learn?

Yes. The Community Edition includes the Proxy, Repeater, and a rate-limited Intruder, which is plenty to learn web testing and to work through the vulnerability walkthroughs here. The paid edition adds speed and the automated scanner, useful later in professional work.

Why do I need Burp if the browser dev tools exist?

Dev tools show you traffic, but Burp lets you pause, systematically modify, replay, and automate requests, and organises everything for testing. That control and workflow is what makes it the standard tool for web assessments.

What are Repeater and Intruder for?

Repeater is for sending one request repeatedly with manual tweaks, ideal for careful, hands-on testing. Intruder automates sending many variations from a wordlist, ideal for brute forcing or fuzzing a parameter. You will use both constantly.

Where to go from here

You just exploited one vulnerability in a lab. Here's the structured path.

Scattered tutorials teach you tricks; they don't make you a pentester. My mentorship is 35 weeks of exactly this, every vulnerability and tool in a deliberate order, on real labs, with one-on-one feedback on your work so your mistakes get caught early instead of becoming habits.

See the mentorship

Keep practising

How to Exploit IDOR How to Exploit SQL Injection How to Use SQLmap