This skill should be used when the user asks to "intercept HTTP traffic", "modify web requests", "use Burp Suite for testing", "perform web vulnerability scanning", "test with Burp Repeater", "analyze HTTP history", or "configure proxy for web testing". It provides comprehensive guidance for using Burp Suite's core features for web application security testing.
Add this skill
npx mdskills install sickn33/burp-suite-testingComprehensive, phase-based Burp Suite guide with clear workflows, examples, and security testing payloads
1---2name: Burp Suite Web Application Testing3description: This skill should be used when the user asks to "intercept HTTP traffic", "modify web requests", "use Burp Suite for testing", "perform web vulnerability scanning", "test with Burp Repeater", "analyze HTTP history", or "configure proxy for web testing". It provides comprehensive guidance for using Burp Suite's core features for web application security testing.4metadata:5 author: zebbern6 version: "1.1"7---89# Burp Suite Web Application Testing1011## Purpose1213Execute comprehensive web application security testing using Burp Suite's integrated toolset, including HTTP traffic interception and modification, request analysis and replay, automated vulnerability scanning, and manual testing workflows. This skill enables systematic discovery and exploitation of web application vulnerabilities through proxy-based testing methodology.1415## Inputs / Prerequisites1617### Required Tools18- Burp Suite Community or Professional Edition installed19- Burp's embedded browser or configured external browser20- Target web application URL21- Valid credentials for authenticated testing (if applicable)2223### Environment Setup24- Burp Suite launched with temporary or named project25- Proxy listener active on 127.0.0.1:8080 (default)26- Browser configured to use Burp proxy (or use Burp's browser)27- CA certificate installed for HTTPS interception2829### Editions Comparison30| Feature | Community | Professional |31|---------|-----------|--------------|32| Proxy | ✓ | ✓ |33| Repeater | ✓ | ✓ |34| Intruder | Limited | Full |35| Scanner | ✗ | ✓ |36| Extensions | ✓ | ✓ |3738## Outputs / Deliverables3940### Primary Outputs41- Intercepted and modified HTTP requests/responses42- Vulnerability scan reports with remediation advice43- HTTP history and site map documentation44- Proof-of-concept exploits for identified vulnerabilities4546## Core Workflow4748### Phase 1: Intercepting HTTP Traffic4950#### Launch Burp's Browser51Navigate to integrated browser for seamless proxy integration:52531. Open Burp Suite and create/open project542. Go to **Proxy > Intercept** tab553. Click **Open Browser** to launch preconfigured browser564. Position windows to view both Burp and browser simultaneously5758#### Configure Interception59Control which requests are captured:6061```62Proxy > Intercept > Intercept is on/off toggle6364When ON: Requests pause for review/modification65When OFF: Requests pass through, logged to history66```6768#### Intercept and Forward Requests69Process intercepted traffic:70711. Set intercept toggle to **Intercept on**722. Navigate to target URL in browser733. Observe request held in Proxy > Intercept tab744. Review request contents (headers, parameters, body)755. Click **Forward** to send request to server766. Continue forwarding subsequent requests until page loads7778#### View HTTP History79Access complete traffic log:80811. Go to **Proxy > HTTP history** tab822. Click any entry to view full request/response833. Sort by clicking column headers (# for chronological order)844. Use filters to focus on relevant traffic8586### Phase 2: Modifying Requests8788#### Intercept and Modify89Change request parameters before forwarding:90911. Enable interception: **Intercept on**922. Trigger target request in browser933. Locate parameter to modify in intercepted request944. Edit value directly in request editor955. Click **Forward** to send modified request9697#### Common Modification Targets98| Target | Example | Purpose |99|--------|---------|---------|100| Price parameters | `price=1` | Test business logic |101| User IDs | `userId=admin` | Test access control |102| Quantity values | `qty=-1` | Test input validation |103| Hidden fields | `isAdmin=true` | Test privilege escalation |104105#### Example: Price Manipulation106107```http108POST /cart HTTP/1.1109Host: target.com110Content-Type: application/x-www-form-urlencoded111112productId=1&quantity=1&price=100113114# Modify to:115productId=1&quantity=1&price=1116```117118Result: Item added to cart at modified price.119120### Phase 3: Setting Target Scope121122#### Define Scope123Focus testing on specific target:1241251. Go to **Target > Site map**1262. Right-click target host in left panel1273. Select **Add to scope**1284. When prompted, click **Yes** to exclude out-of-scope traffic129130#### Filter by Scope131Remove noise from HTTP history:1321331. Click display filter above HTTP history1342. Select **Show only in-scope items**1353. History now shows only target site traffic136137#### Scope Benefits138- Reduces clutter from third-party requests139- Prevents accidental testing of out-of-scope sites140- Improves scanning efficiency141- Creates cleaner reports142143### Phase 4: Using Burp Repeater144145#### Send Request to Repeater146Prepare request for manual testing:1471481. Identify interesting request in HTTP history1492. Right-click request and select **Send to Repeater**1503. Go to **Repeater** tab to access request151152#### Modify and Resend153Test different inputs efficiently:154155```1561. View request in Repeater tab1572. Modify parameter values1583. Click Send to submit request1594. Review response in right panel1605. Use navigation arrows to review request history161```162163#### Repeater Testing Workflow164165```166Original Request:167GET /product?productId=1 HTTP/1.1168169Test 1: productId=2 → Valid product response170Test 2: productId=999 → Not Found response171Test 3: productId=' → Error/exception response172Test 4: productId=1 OR 1=1 → SQL injection test173```174175#### Analyze Responses176Look for indicators of vulnerabilities:177178- Error messages revealing stack traces179- Framework/version information disclosure180- Different response lengths indicating logic flaws181- Timing differences suggesting blind injection182- Unexpected data in responses183184### Phase 5: Running Automated Scans185186#### Launch New Scan187Initiate vulnerability scanning (Professional only):1881891. Go to **Dashboard** tab1902. Click **New scan**1913. Enter target URL in **URLs to scan** field1924. Configure scan settings193194#### Scan Configuration Options195196| Mode | Description | Duration |197|------|-------------|----------|198| Lightweight | High-level overview | ~15 minutes |199| Fast | Quick vulnerability check | ~30 minutes |200| Balanced | Standard comprehensive scan | ~1-2 hours |201| Deep | Thorough testing | Several hours |202203#### Monitor Scan Progress204Track scanning activity:2052061. View task status in **Dashboard**2072. Watch **Target > Site map** update in real-time2083. Check **Issues** tab for discovered vulnerabilities209210#### Review Identified Issues211Analyze scan findings:2122131. Select scan task in Dashboard2142. Go to **Issues** tab2153. Click issue to view:216 - **Advisory**: Description and remediation217 - **Request**: Triggering HTTP request218 - **Response**: Server response showing vulnerability219220### Phase 6: Intruder Attacks221222#### Configure Intruder223Set up automated attack:2242251. Send request to Intruder (right-click > Send to Intruder)2262. Go to **Intruder** tab2273. Define payload positions using § markers2284. Select attack type229230#### Attack Types231232| Type | Description | Use Case |233|------|-------------|----------|234| Sniper | Single position, iterate payloads | Fuzzing one parameter |235| Battering ram | Same payload all positions | Credential testing |236| Pitchfork | Parallel payload iteration | Username:password pairs |237| Cluster bomb | All payload combinations | Full brute force |238239#### Configure Payloads240241```242Positions Tab:243POST /login HTTP/1.1244...245username=§admin§&password=§password§246247Payloads Tab:248Set 1: admin, user, test, guest249Set 2: password, 123456, admin, letmein250```251252#### Analyze Results253Review attack output:254255- Sort by response length to find anomalies256- Filter by status code for successful attempts257- Use grep to search for specific strings258- Export results for documentation259260## Quick Reference261262### Keyboard Shortcuts263| Action | Windows/Linux | macOS |264|--------|---------------|-------|265| Forward request | Ctrl+F | Cmd+F |266| Drop request | Ctrl+D | Cmd+D |267| Send to Repeater | Ctrl+R | Cmd+R |268| Send to Intruder | Ctrl+I | Cmd+I |269| Toggle intercept | Ctrl+T | Cmd+T |270271### Common Testing Payloads272273```274# SQL Injection275' OR '1'='1276' OR '1'='1'--2771 UNION SELECT NULL--278279# XSS280<script>alert(1)</script>281"><img src=x onerror=alert(1)>282javascript:alert(1)283284# Path Traversal285../../../etc/passwd286..\..\..\..\windows\win.ini287288# Command Injection289; ls -la290| cat /etc/passwd291`whoami`292```293294### Request Modification Tips295- Right-click for context menu options296- Use decoder for encoding/decoding297- Compare requests using Comparer tool298- Save interesting requests to project299300## Constraints and Guardrails301302### Operational Boundaries303- Test only authorized applications304- Configure scope to prevent accidental out-of-scope testing305- Rate-limit scans to avoid denial of service306- Document all findings and actions307308### Technical Limitations309- Community Edition lacks automated scanner310- Some sites may block proxy traffic311- HSTS/certificate pinning may require additional configuration312- Heavy scanning may trigger WAF blocks313314### Best Practices315- Always set target scope before extensive testing316- Use Burp's browser for reliable interception317- Save project regularly to preserve work318- Review scan results manually for false positives319320## Examples321322### Example 1: Business Logic Testing323324**Scenario**: E-commerce price manipulation3253261. Add item to cart normally, intercept request3272. Identify `price=9999` parameter in POST body3283. Modify to `price=1`3294. Forward request3305. Complete checkout at manipulated price331332**Finding**: Server trusts client-provided price values.333334### Example 2: Authentication Bypass335336**Scenario**: Testing login form3373381. Submit valid credentials, capture request in Repeater3392. Send to Repeater for testing3403. Try: `username=admin' OR '1'='1'--`3414. Observe successful login response342343**Finding**: SQL injection in authentication.344345### Example 3: Information Disclosure346347**Scenario**: Error-based information gathering3483491. Navigate to product page, observe `productId` parameter3502. Send request to Repeater3513. Change `productId=1` to `productId=test`3524. Observe verbose error revealing framework version353354**Finding**: Apache Struts 2.5.12 disclosed in stack trace.355356## Troubleshooting357358### Browser Not Connecting Through Proxy359- Verify proxy listener is active (Proxy > Options)360- Check browser proxy settings point to 127.0.0.1:8080361- Ensure no firewall blocking local connections362- Use Burp's embedded browser for reliable setup363364### HTTPS Interception Failing365- Install Burp CA certificate in browser/system366- Navigate to http://burp to download certificate367- Add certificate to trusted roots368- Restart browser after installation369370### Slow Performance371- Limit scope to reduce processing372- Disable unnecessary extensions373- Increase Java heap size in startup options374- Close unused Burp tabs and features375376### Requests Not Being Intercepted377- Verify "Intercept on" is enabled378- Check intercept rules aren't filtering target379- Ensure browser is using Burp proxy380- Verify target isn't using unsupported protocol381
Full transparency — inspect the skill content before installing.