Kali Linux Day 12: Burp Suite Kali Linux 2026 — Install, Configure & Intercept Your First HTTPS Request

In Day 11 we used Aircrack-ng to capture and crack WPA2 handshakes, operating at the network layer. Today we move up the stack entirely. Burp Suite operates at the application layer — it sits between your browser and every web server you point it at, giving you complete read and write access to every HTTP and HTTPS request in real time. This is the tool that makes web application penetration testing possible, and it is the tool used in virtually every Kali Linux 180-Day Mastery Course web engagement from here forward.

What Is Burp Suite and Why Every Hacker Uses It

Burp Suite is an integrated platform for web application security testing developed by PortSwigger. It is the industry standard tool used by professional penetration testers, bug bounty hunters, and security engineers worldwide. The Community Edition — which is completely free and ships with Kali Linux — gives you everything you need to understand and test web applications at a professional level.

The architecture is elegantly simple. Burp Suite runs as a local proxy on your machine, typically listening on port 8080. You configure your browser to route all traffic through this proxy. Every request your browser sends — including encrypted HTTPS requests — passes through Burp first. Burp decrypts it, shows it to you in plain text, lets you modify it if you want, then forwards it to the server. The server’s response comes back through Burp the same way before reaching your browser.

This man-in-the-middle position is not an attack in this context — it is your testing environment. It gives you the ability to see exactly what data the application is sending, modify parameters before they reach the server, repeat requests with different payloads, and map the entire attack surface of an application. Without Burp Suite, web application testing is guesswork. With it, everything becomes visible.

The Community Edition gives you the Proxy, Repeater, Intruder (rate-limited), Decoder, Comparer, and the Target site map. These six tools cover the vast majority of what you will need for manual web application testing. The Pro version unlocks unlimited Intruder speed and an automated scanner, but everything in this guide works on the free version.

Burp Suite Kali Linux 2026 — Install and First Launch

Burp Suite Community Edition comes pre-installed on Kali Linux. You do not need to download anything separately. However, it is worth knowing how to update it and verify the installation before you start configuring it for HTTPS interception.

When Burp Suite launches for the first time, it presents you with a project selection screen. For the Community Edition, select “Temporary project” and click Next. On the configuration screen, select “Use Burp defaults” and click “Start Burp”. This opens the main Burp Suite interface with the Dashboard tab active.

The first thing to note is the tab bar at the top: Dashboard, Target, Proxy, Intruder, Repeater, Sequencer, Decoder, Comparer, Logger, and Extender. You will work primarily in Target, Proxy, Repeater, and Intruder. The Dashboard shows active scan tasks — less relevant in Community Edition, but useful to understand. Take 60 seconds to click each tab and familiarise yourself with the layout before moving on.

How to Configure Burp Proxy and Intercept HTTPS Traffic

This is the most critical configuration step in all of Burp Suite setup. If you get this wrong, Burp will intercept HTTP traffic but throw SSL errors on every HTTPS site — which is every modern website. The solution is a two-step process: configure your browser to route traffic through Burp’s proxy, then install Burp’s CA certificate so your browser trusts the interception.

With FoxyProxy active and the CA certificate installed, go to Burp Suite, click the Proxy tab, then click “Intercept” — you will see a button labelled “Intercept is off”. Click it to turn interception on. Now go back to Firefox and navigate to any website. The browser will appear to hang — because Burp is holding the request, waiting for you to review it. In Burp you will see the raw HTTP request displayed in the Intercept panel. Click “Forward” to send it through, or “Drop” to discard it.

Web Application Testing Kali Linux — Proxy, Repeater and Intruder Explained

Burp Suite’s power comes from understanding how its core tools work together. The Proxy is your passive capture tool — it records everything. Repeater is your manual testing tool — it lets you replay modified requests. Intruder is your automation tool — it lets you fuzz parameters with wordlists. These three tools alone cover 80% of manual web application testing work.

Burp Proxy — HTTP History: Even when Intercept is turned off, Burp continues to log every request in the background under Proxy > HTTP History. This is your session log. After browsing through an application with intercept off, you can come back to HTTP History, find any request, right-click it, and send it to Repeater or Intruder for testing. This workflow — browse first, test second — is how professionals approach a new application.

Burp Repeater — Manual Parameter Testing: Repeater is where you spend most of your manual testing time. You send a request here, modify a parameter value, click Send, and see the server’s response immediately. You can compare responses side by side, test different payloads in seconds, and iterate rapidly. For testing SQL injection, XSS, IDOR, and authentication bypass, Repeater is your workbench.

Burp Intruder — Automated Fuzzing: Intruder lets you define one or more payload positions in a request and then fuzz them with a wordlist or number sequence. The Community Edition rate-limits Intruder to roughly one request per second — frustrating for large wordlists, but entirely sufficient for learning. For brute-forcing login forms with a top-100 password list on DVWA, it works perfectly.

Setting Target Scope and Using the HTTP History

One of the most important habits in professional web application testing is defining your target scope before you start testing. Burp’s Target > Scope feature lets you specify exactly which hosts and URLs Burp should log and interact with. This prevents your HTTP History from filling up with irrelevant requests from browser background processes, telemetry calls, and CDN traffic.

With scope defined, the Target > Site Map tab becomes genuinely useful. As you browse through the application with Intercept off, Burp automatically builds a tree of every URL, directory, and parameter it has seen. This passive crawl shows you the full attack surface of the application — directories you might not have visited, parameters that appear in query strings, and endpoints the application references in its JavaScript.

Professional penetration testers always spend 20–30 minutes in passive crawl mode before touching a single parameter. You are mapping before you attack. The same intelligence-first philosophy you applied with theHarvester on Day 9 applies to web application testing — map everything before you start testing anything.

Burp Suite Tutorial 2026 — Testing DVWA With All Four Tools

Now that Burp is configured and you have intercepted your first request, let us walk through a complete testing workflow against DVWA using all four core tools together. This is the workflow you will use on every web application engagement going forward.

Phase 1 — Passive Crawl: With Intercept off, browse every page of DVWA manually. Click every link, submit every form with test data, and navigate every menu item. Burp is silently recording everything in HTTP History. After 10 minutes of browsing, open Target > Site Map and you will see the full directory structure of the application mapped out automatically.

Phase 2 — Parameter Identification: In HTTP History, filter by POST requests. These are your highest-value targets — forms that submit user-controlled data to the server. Look specifically for parameters that might query a database (id=, user=, search=), execute commands (cmd=, exec=, ping=), or reference files (file=, path=, page=).

Phase 3 — Manual Testing in Repeater: Send interesting requests to Repeater. In DVWA’s Command Injection module, for example, you will find a ping field. Send that request to Repeater and test what happens when you add ; id after a valid IP address. The response will tell you immediately whether the application is vulnerable.

Phase 4 — Intruder for Brute Force: For the DVWA brute force module, capture a login POST request and send it to Intruder. In the Positions tab, highlight the password value and click “Add §”. Set the attack type to Sniper, load a wordlist in the Payloads tab, and start the attack. Sort results by response length — the valid password will have a noticeably different length from the failed attempts.

This four-phase workflow — passive crawl, parameter identification, manual Repeater testing, Intruder automation — is the foundation of every web application penetration test. The Burp Suite cheat sheet covers the keyboard shortcuts and Repeater tips that will make you significantly faster once you have this workflow memorised.