Day 12: Burp Suite Setup — Intercept Your First Web Request in 10 Minutes (2026)

This article is a practical setup and introduction guide to Burp Suite, a web application security testing proxy tool, positioned as Day 12 of a 100-day penetration testing curriculum. It covers the installation, configuration, and first use of Burp Suite's core features for intercepting, inspecting, and modifying HTTP and HTTPS web traffic. The article matters because Burp Suite is described as the industry standard for web security testing, and mastering its basics is foundational to identifying web vulnerabilities in subsequent training modules.

• Burp Suite as a Man-in-the-Middle ProxyBurp Suite functions as a proxy that sits between the browser and web server on port 127.0.0.1:8080, allowing it to intercept, read, modify, and replay every HTTP and HTTPS request and response. This position gives testers the ability to see sensitive data like login credentials in plain text, session cookies, and API payloads, then alter any field before forwarding requests to the server—a capability that is core to vulnerability testing.
• HTTPS Interception via CA Certificate InstallationBurp generates its own Transport Layer Security certificate for each HTTPS site visited and signs it with Burp's Certificate Authority. Installing Burp's CA certificate into Firefox's trusted certificate authorities allows the browser to accept these dynamically generated certificates, enabling seamless HTTPS traffic interception without certificate warnings. This one-time installation is critical for testing encrypted traffic but should only be done in a dedicated testing browser profile, not everyday browsers.
• Two Interception Modes: Active and PassiveThe Intercept tab pauses individual requests mid-flight for inspection and modification before forwarding, while the HTTP History tab silently logs all traffic without stopping it. The article demonstrates this distinction by showing how Intercept freezes a DVWA login POST request mid-flight to reveal credentials and CSRF tokens, while HTTP History passively records every navigation click and API call for later review without disrupting browsing.
• Repeater Tool for Iterative TestingThe Repeater tab allows testers to take a captured request, modify it in an editable panel, send it with one click, and instantly view the server response—enabling dozens of modified requests per minute without re-navigating the browser. The article demonstrates this with SQL injection payload testing, showing how changing id=1 to id=1' reveals SQL errors, id=1 OR 1=1-- returns all users, and boolean tests like id=1 AND 1=2 return nothing—all executed from within Repeater without leaving the tool.
• Decoder for Encoding Format TranslationThe Decoder tab instantly translates between common web encoding formats—URL encoding, Base64, HTML entities, hex, ASCII, and GZIP—allowing testers to unmask obfuscated data in cookies, form fields, and parameters. The article shows practical examples: %40 and %21 decoding to @ and !, and a Base64-encoded cookie revealing a JSON structure with a role field that could be modified and re-encoded to escalate privileges.
• Target Scope Definition for Focused TestingThe Target Scope feature restricts Burp's capture to specific protocols, hosts, ports, and file paths using regex patterns, preventing the tool from logging noise from unrelated domains and background requests. The article demonstrates adding DVWA to scope by specifying http://192.168.56.101:80 with /dvwa/.* pattern, then using 'Show only in-scope items' filter to keep HTTP History focused solely on the target application.
• Practical First Intercept: DVWA Login RequestThe article walks through intercepting a live DVWA login POST request containing username=admin, password=password, and a CSRF token (user_token). This hands-on example demonstrates that testers can view credentials in clear text, modify any field (e.g., changing username to administrator or adding SQL injection payloads), and delete security headers like CSRF tokens to test server validation—establishing the core testing workflow.
• Daily Professional Workflow RequirementsThe article establishes that Burp Suite must remain open every day from Day 12 forward in the curriculum, uses 'Temporary project' mode for daily practice (vs. saved projects for long-running engagements), and recommends the FoxyProxy extension for one-click proxy toggling rather than repeatedly digging into Firefox settings. It also stresses verifying the proxy listener is running (Proxy tab → Proxy settings) before testing and disabling the proxy when finished to avoid breaking normal browsing.

Bottom line: Burp Suite is a proxy-based tool that must be configured once with a CA certificate and browser proxy settings, then becomes the primary platform for all web security testing by allowing testers to intercept, inspect, modify, and replay HTTP/HTTPS traffic in real time. Mastery comes through daily use across the Intercept, HTTP History, Repeater, and Decoder tabs to methodically test for vulnerabilities like SQL injection, and the practical first exercise—intercepting a live DVWA login request—pr