Proxy and Interception

Burp Suite is the most widely used web application security testing platform. At its core it is an intercepting proxy that sits between your browser and the target server.

Because all traffic flows through Burp, you can read and modify every request and response.

An intercepting proxy is a man-in-the-middle that you control. Your browser sends requests to Burp; Burp forwards them to the server and returns the responses.

This lets you pause, inspect, and edit traffic at will.

Burp listens on a local port, by default 127.0.0.1:8080. You point your browser's proxy settings at that address.

The Proxy and Options tabs let you confirm or change the listener.

Modern Burp ships with a preconfigured embedded Chromium browser. It already trusts Burp and routes through the proxy, so you avoid manual setup.

Click 'Open Browser' in the Proxy tab to start testing immediately.

To intercept HTTPS, your browser must trust Burp's CA certificate. Otherwise you get TLS warnings.

Download it from http://burpsuite while the proxy runs, then import it into the browser or OS trust store.

The Intercept toggle decides whether requests pause for your review. With it on, each request waits until you forward or drop it.

Turn it off to browse normally while Burp still logs everything in the HTTP history.

When intercept is on, you can edit the raw request before forwarding it. Change a parameter, header, or method on the fly.

This is the simplest form of manual testing.

The HTTP history tab records every request and response that passed through the proxy, even with intercept off.

You can filter, search, and right-click any entry to send it to other Burp tools.

Define a target scope so Burp only acts on the systems you are authorized to test. This prevents accidentally attacking third-party domains.

Set scope in the Target tab and enable 'show only in-scope items'.

The real power comes from forwarding a captured request to Burp's other tools.

• Send to Repeater for manual tweaking.
• Send to Intruder for automated payloads.
• Send to Scanner for automated checks.

Burp can automatically rewrite traffic with match and replace rules, for example injecting a header into every request.

This is handy for adding auth tokens or testing how the app behaves with modified headers.

Test your understanding of the proxy.

You learned the Burp Suite proxy basics.

• Burp is an intercepting proxy between browser and server.
• Listener defaults to 127.0.0.1:8080.
• Trust the CA certificate to intercept HTTPS.
• Intercept pauses requests; HTTP history logs everything.
• Define a target scope and forward requests to other tools.

Next you will use Repeater and Intruder to manipulate requests.