1. Mental Model & Architectural Core
Burp Suite Professional is the de facto standard web application security testing platform. It intercepts all HTTP/S traffic between your browser and the target, allowing you to modify requests, fuzz parameters, scan for vulnerabilities, and perform advanced attacks including HTTP desynchronization and race conditions.
Burp Suite is the universal translator and editor between you and any web application. Every HTTP request your browser sends passes through Burp's proxy you can read it, modify it, replay it, fuzz it with thousands of variations, or send it through any of 30+ specialized attack tools before it reaches the server.
- Web application penetration testing (primary tool for all web attacks)
- Intercepting and modifying API requests and GraphQL queries
- SQL injection, XSS, SSRF, XXE, IDOR, and SSTI testing
- HTTP request smuggling and desynchronization attacks
- Race condition exploitation with Turbo Intruder
- PortSwigger Web Security Academy labs
- Send a login request to Repeater, modify the JWT token to test algorithm confusion (alg:none)
- Use Intruder to brute-force a 4-digit OTP bypass in under 10,000 requests
- Detect blind SSRF via Burp Collaborator DNS callbacks from server-side URL parameters
- Exploit HTTP/2 request smuggling via the Repeater HTTP/2 raw mode
Burp Suite operates as a localhost HTTP proxy (default 127.0.0.1:8080). Your browser routes all traffic through this proxy. Burp's interception engine can pause, display, and modify any request before forwarding it. The Scanner uses a proprietary crawl+fuzz engine to automatically identify injection points. Collaborator is an out-of-band interaction server (DNS, HTTP) for detecting blind vulnerabilities like SSRF and blind XXE.
2. Syntax, Flags & Live Telemetry
| Flag / Option | Description |
|---|---|
| Proxy → Intercept ON/OFF | Toggle request interception modify requests on the fly |
| Send to Repeater (Ctrl+R) | Send captured request to Repeater for manual modification and replay |
| Send to Intruder (Ctrl+I) | Send to Intruder for automated fuzzing with payload lists |
| Intruder → Sniper | Single injection point, one payload list simplest attack mode |
| Intruder → Cluster Bomb | Multiple injection points with independent payload lists (e.g., username + password brute force) |
| Extensions → Turbo Intruder | High-speed, scriptable HTTP fuzzer for race conditions and large payload sets |
| Collaborator → Poll now | Check for out-of-band DNS/HTTP interactions from blind SSRF/XXE payloads |
| Decoder tab | Encode/decode URL, Base64, HTML, Hex quickly manipulate token values |
# In Turbo Intruder, load race_single_packet.py and set gate='race1' python3 turbo_intruder_race.py --target https://shop.target.lab/api/checkout
GET /api/fetch?url=http://8x0h2w4uifz9dq3mq1fplr5jz0.oastify.com/ HTTP/1.1
Set Burp's "Match and Replace" rules to automatically add headers like X-Forwarded-For: 127.0.0.1 or X-Original-URL to every request this tests for IP-based access controls on every single request without manual effort.
3. Hands-On Practice Labs & Cyber Ranges
4. Detection & Prevention Playbook
- Deploy WAF with request anomaly detection (rate limiting, payload signatures)
- Implement anti-automation via CAPTCHA on sensitive endpoints
- Log and alert on identical request patterns with fuzzing payloads (null bytes, SQLi chars)
- Enable HSTS and certificate pinning to prevent proxy interception