Cyber Security Academy · Lesson

Burp Suite Proxy and Intercepting Requests

Configure Burp Suite, intercept HTTP traffic, and use Repeater to manually test inputs.

Burp Suite Proxy and Intercepting Requests is a free Cyber Security Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why Intercept HTTP Traffic?

Web application security testing requires seeing and modifying every HTTP request and response. Burp Suite acts as a man-in-the-middle proxy between your browser and the target, giving you full visibility and control.

Burp Suite Editions

Burp Community (free): proxy, repeater, intruder (rate-limited), decoder. Burp Pro: active scanner, full intruder, collaborator. For most learning and manual testing, Community is sufficient.

Setting Up the Proxy

Burp listens on 127.0.0.1:8080 by default. Configure your browser to proxy HTTP/HTTPS through this address. Use FoxyProxy (Firefox extension) for easy toggle.

# Start Burp Suite
# Proxy > Options > check listener: 127.0.0.1:8080

# Firefox: Settings > Network > Manual proxy
# HTTP Proxy: 127.0.0.1  Port: 8080

# Or use FoxyProxy extension for quick toggle

Installing the CA Certificate

To intercept HTTPS, install Burp's CA certificate in your browser. Visit http://burpsuite in your proxied browser to download it, then add it to the browser's trusted certificate store.

# Download Burp CA cert:
# Browse to: http://burpsuite (while proxy is active)
# Download cacert.der

# Firefox: Settings > Certificates > Import
# Chrome: Settings > Security > Manage certificates

Intercepting Requests

With Intercept ON, every request pauses in Burp for inspection before forwarding. Toggle intercept on/off depending on whether you want to stop at each request or just passively record traffic.

# Proxy > Intercept > Intercept is on

# For each intercepted request:
# - Forward: send as-is
# - Drop: cancel the request
# - Action: send to Repeater/Intruder
# - Edit fields before forwarding

The HTTP History

Proxy > HTTP History records all proxied requests and responses. Right-click any request to send it to Repeater, Intruder, Scanner, or Decoder. This is your main workspace for finding input points.

Burp Repeater

Repeater lets you modify and replay individual requests manually. Select a request, edit parameters, headers, or body, and compare responses side by side. Essential for testing individual inputs.

# Send to Repeater:
# Right-click request > Send to Repeater
# Or Ctrl+R

# In Repeater:
# Edit the request
# Click Send
# Compare responses in the right panel

Burp Intruder

Intruder automates parameter fuzzing. Mark positions (§payload§), load a wordlist, choose attack type (Sniper, Pitchfork, Cluster Bomb), and run. Analyze responses for length differences indicating successful hits.

# Attack types:
# Sniper: one position, iterate wordlist
# Battering Ram: same payload all positions
# Pitchfork: parallel wordlists per position
# Cluster Bomb: all combinations

Decoder and Comparer

Decoder transforms data between Base64, URL encoding, HTML entities, hex, and more. Comparer diffs two responses or requests to spot differences — useful for blind injection testing.

Burp Target Scope

Set the Target Scope to only your authorized target. Burp will only intercept and test in-scope requests, preventing accidental testing of third-party services.

# Target > Scope > Add
# Enter: https://target.com

# Proxy > Options > Intercept:
# "And URL Is in target scope"

Saving and Restoring Projects

Burp Pro saves state to a project file. In Community, export the HTTP history and individual requests to maintain records. Document key findings directly in Burp's notes feature.

Quick Check

What is the purpose of Burp Repeater?

Summary: Burp Suite

Burp Suite is the central tool for web application pentesting. The proxy captures all traffic; HTTP History gives you the full site map of requests; Repeater lets you manually test individual inputs; Intruder automates fuzzing. Always set scope to authorized targets only and install the CA cert for HTTPS interception.

Frequently asked questions

Is the “Burp Suite Proxy and Intercepting Requests” lesson free?

Yes — the full text of “Burp Suite Proxy and Intercepting Requests” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Burp Suite Proxy and Intercepting Requests”?

Configure Burp Suite, intercept HTTP traffic, and use Repeater to manually test inputs. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Burp Suite Proxy and Intercepting Requests” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

Burp Suite Proxy and Intercepting Requests
Testing for Injection Vulnerabilities
Authentication and Session Testing
File Upload and SSRF Vulnerabilities

← Back to Cyber Security Academy