Burp Suite
Burp Suite is a web application security testing platform built around an intercepting proxy, available in a free Community edition and paid Professional/Enterprise editions.
Legal & ethical use. Test only applications you own or are explicitly authorised to test (for example local practice labs and PortSwigger Academy). Use this tool only on systems, networks and data that you own or have explicit written permission to test. Unauthorised access or scanning can break computer-misuse laws (for example Pakistan's Prevention of Electronic Crimes Act, 2016, and equivalents elsewhere). Practise in your own lab or in authorised environments such as CTFs.
What it is used for
- Intercept and modify browser requests in a local practice app
- Replay requests with Repeater to test input handling
- Practise with PortSwigger's free Web Security Academy labs
Key features
- Intercepting proxy
- Repeater and Intruder (limited in Community)
- Decoder and Comparer
- Extension ecosystem (BApp Store)
Installation
Download the installer from portswigger.net/burp/releases. Community edition is free; scanner features need Professional.
Beginner usage guide
Point your browser at Burp's proxy listener, install Burp's CA certificate in a separate test browser profile, browse your practice app and study each request in the HTTP history.
Example commands
Run these only against your own lab or authorised targets. Placeholder addresses such as 192.0.2.x are documentation ranges.
Default proxy listener (setting)
127.0.0.1:8080Set this as the proxy in your test browser so traffic flows through Burp.
Keep learning
🎓 Learning path: OWASP Top 10
🎓 Learning path: Web Security
References
Source verification
Last reviewed: 2026-10-27
Links checked over HTTP: 2026-10-27 07:51 UTC — official: 200, docs: 200, repo: 200
Commands were written from the official documentation and have not been executed on this site; test them in your lab.