Cyber Security Academy · Lesson

Practical Workflows

Test a web app end to end.

Practical Workflows is a free Cyber Security Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Putting It Together

You now know the individual Burp tools. This lesson chains them into a realistic end-to-end workflow for testing a web application.

A repeatable workflow keeps you thorough and prevents missed areas.

Step 1: Define Scope

Before touching anything, set the target scope from the rules of engagement. This keeps every tool focused and lawful.

Enable 'in-scope only' filters across Burp.

Target -> Scope
  Include: https://shop.example.com
  Exclude: payment.partner.com

Step 2: Map the Application

Browse the whole app through the proxy with the embedded browser. As you click, Burp builds a site map of URLs and parameters.

Step 3: Review HTTP History

Scan the HTTP history for interesting requests: anything with IDs, tokens, file uploads, or admin paths.

These are your candidate targets for deeper manual testing.

Interesting patterns:
  /api/order?id=1042
  /admin/users
  POST /upload
  Authorization: Bearer ...

Step 4: Automated Sweep

Kick off a Scanner audit on the in-scope site map to catch obvious issues while you continue manually.

Let automation run in the background; you focus on logic.

Step 5: Test Access Control

Take a request with a resource ID into Repeater and change the ID to another user's. If you get their data, you have an IDOR.

The Autorize extension automates this across the whole session.

GET /api/order?id=1042  (your order)
-> change to id=1043
-> 200 with another user's order = IDOR

Step 6: Fuzz Inputs

Send promising parameters to Intruder and fuzz them with injection payloads to probe for SQLi, XSS, and command injection.

Watch the results for error responses or reflected payloads.

Position: search=SS-payload-SS
Payloads: ' OR 1=1 -- , <script>, ;id;
Watch:    500 errors, reflections

Step 7: Test Authentication

Probe the login and session logic: weak passwords, missing rate limits, predictable tokens, and session fixation.

Intruder brute forces credentials; Repeater inspects how tokens are issued and reused.

Step 8: Verify Every Hit

Reproduce each candidate finding cleanly in Repeater. Confirm it, capture the request/response evidence, and assign a severity.

Discard false positives before they reach your notes.

Step 9: Collect Evidence

For each confirmed finding, save the exact request and response, plus a screenshot if the impact is visual.

Redact any real customer data immediately.

Save per finding:
  - raw request
  - raw response (redacted)
  - screenshot (if visual)
  - CVSS vector

Step 10: Report

Feed your verified findings into the report structure you learned earlier: executive summary, risk table, detailed findings, and remediation.

The Burp workflow produces the raw material; clear writing turns it into value.

Quick Check

Test your understanding of the workflow.

Recap

You learned an end-to-end Burp workflow.

Define scope, then map the app via the proxy.
Review HTTP history; run a Scanner sweep.
Use Repeater for access control, Intruder for fuzzing and auth.
Verify every hit and collect redacted evidence.
Feed verified findings into a structured report.

You have completed the Burp Suite Mastery course.

Frequently asked questions

Is the “Practical Workflows” lesson free?

Yes — the full text of “Practical Workflows” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Practical Workflows”?

Test a web app end to end. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Practical Workflows” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Cyber Security Academy