Burp Suite for Beginners: Proxy, Repeater and Intruder Explained

Burp Suite is the main tool of web application testers. It sits between your browser and a website, so you can see and change every request. Once you are comfortable with it, the ideas in the OWASP Top 10 stop being theory. This guide covers setup and the four tools you will use most.

Community or Professional?

PortSwigger publishes a free Community Edition and a paid Professional Edition. Community includes the proxy, Repeater, Decoder and a slowed-down Intruder, which is plenty for learning. Professional adds an automated scanner, full-speed Intruder and other time-savers that matter in paid work.

Setting Up

The easiest start is Burp's built-in browser: open the Proxy tab and launch it, and traffic flows through Burp with no certificate setup. To use your own browser instead, point it at Burp's proxy (127.0.0.1 port 8080 by default) and install Burp's certificate so HTTPS sites load. Set a target scope early, so Burp only records the application you are authorized to test.

Proxy: See Every Request

With interception on, each request stops in Burp before it reaches the server. You can read it, change a parameter, then forward it. The HTTP history keeps a record of everything, which is often more useful than intercepting live. Look at cookies, hidden fields, IDs and tokens.

Repeater: Change and Resend

Send any request to Repeater, change one thing, resend and compare the response. This is where most manual testing happens: changing an order ID to test access control, adding a quote to test for SQL injection, removing a token to test authentication.

Intruder: Automate Variations

Intruder sends many versions of a request, changing the positions you choose with a list of values: a range of IDs, a list of usernames, a set of payloads. In Community Edition it is rate-limited, so keep lists short. On real targets, respect any limits in the rules of engagement or bug bounty policy.

Decoder and Comparer

Decoder converts between URL encoding, Base64, HTML entities and hex, which you will need constantly. Comparer shows the difference between two responses, useful when a small change in a request causes a small change in the result.

Where to Practice

PortSwigger's free Web Security Academy is designed for Burp, with labs for every major vulnerability class. OWASP Juice Shop in your home lab is another good target. Never point Burp at a site you are not authorized to test.

Learning with an Instructor

Burp Suite is the core tool in our Application Security course, alongside OWASP ZAP and Postman, from access-control testing to JWT handling and GraphQL.