Proxy and Interception
Capture requests.
Proxy and Interception is a free Ethical Hacking Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Ethical Hacking Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What Is Burp Suite?
Burp Suite is an integrated platform for testing the security of web applications. It sits between your browser and the target server as an intercepting proxy, letting you inspect and modify every HTTP/HTTPS request and response.
- Proxy — intercept traffic
- Repeater — manually replay requests
- Intruder — automate fuzzing
- Scanner — find vulnerabilities (Pro)
The Intercepting Proxy
Burp's Proxy listens on a local port (default 127.0.0.1:8080). Your browser is configured to send all traffic through it, so Burp can pause requests before they reach the server.
This man-in-the-middle position is what makes web testing possible: you see exactly what the application sends, including hidden parameters and headers.
Proxy listener: 127.0.0.1:8080
Browser proxy setting -> HTTP/HTTPS host 127.0.0.1 port 8080Configuring Your Browser
Point the browser at Burp's listener. The easiest path is a browser extension like FoxyProxy, or Burp's own built-in Chromium browser (Proxy > Intercept > Open Browser) which is pre-configured.
FoxyProxy profile:
Proxy Type: HTTP
Host: 127.0.0.1
Port: 8080Installing Burp's CA Certificate
To intercept HTTPS, Burp generates its own certificates on the fly. The browser will not trust them unless you install Burp's CA certificate.
Visit http://burp while the proxy is running, download cacert.der, and import it into the browser/OS trust store.
Browse to: http://burp
Download: cacert.der
Import into: Trusted Root Certification AuthoritiesIntercept On vs Off
In Proxy > Intercept, the Intercept is on toggle pauses each request so you can read or edit it before forwarding. With intercept off, traffic flows freely but is still recorded in the HTTP history.
Use Forward to send the paused request, or Drop to discard it.
Reading a Captured Request
An intercepted request shows the method, path, headers, and body. You can edit any part inline before forwarding — change a parameter, add a header, or tamper with a cookie.
POST /login HTTP/1.1
Host: target.local
Content-Type: application/x-www-form-urlencoded
Cookie: session=abc123
username=admin&password=testHTTP History
The Proxy > HTTP history tab logs every request that passed through Burp, even with intercept off. Each entry records URL, status, length, and MIME type. This is your timeline of the whole session.
Right-click any entry to send it to Repeater, Intruder, or other tools.
Scoping the Target
Real apps generate noise from analytics, CDNs, and third parties. Define a target scope under Target > Scope so Burp focuses only on the hosts you are authorized to test.
Enable "And URL Is in target scope" filters to keep history clean and avoid touching out-of-scope systems.
Target > Scope > Include in scope:
https://target.local/.*Match and Replace Rules
Under Proxy > Match and replace you can automatically rewrite parts of every request or response — for example spoofing a User-Agent or stripping a security header to study behavior.
Type: Request header
Match: ^User-Agent.*$
Replace: User-Agent: BurpTest/1.0Why Interception Matters
Client-side validation (JavaScript, hidden fields, disabled buttons) is trivially bypassed once you can edit requests in transit. Interception reveals the difference between what the UI allows and what the server actually enforces.
Always test server-side controls, never trust the client.
Legal and Ethical Use
Intercepting traffic is powerful and intrusive. Only ever run Burp against systems you own or have written authorization to test. Define scope precisely and respect it.
Unauthorized interception is illegal in most jurisdictions.
Quick Check
Test your understanding of Burp's proxy.
Recap
You learned how Burp Suite's intercepting proxy works:
- Burp listens on
127.0.0.1:8080and the browser routes traffic through it - Installing the CA cert enables HTTPS interception
- Intercept pauses requests for editing; HTTP history logs everything
- Scope keeps testing focused and authorized
Next we modify and fuzz requests with Repeater and Intruder.
Frequently asked questions
Is the “Proxy and Interception” lesson free?
Yes — the full text of “Proxy and Interception” is free to read here on the web, and the Ethical Hacking Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Ethical Hacking Academy course, upgrade to CoddyKit PRO.
What will I learn in “Proxy and Interception”?
Capture requests. You practise Ethical Hacking Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Ethical Hacking Academy?
No prior experience is required. Ethical Hacking Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Proxy and Interception” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Ethical Hacking Academy lesson?
Yes. Every Ethical Hacking Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Proxy and Interception
- Repeater and Intruder
- Scanner
- Extensions