Burp Suite Basics in a Local Practice Lab
By CyberSecurity.pk · Oct 27, 2026 · updated Oct 27, 2026
What Burp does
Burp Suite sits between your browser and a web application. You can inspect, modify and resend requests, which is how many web testers learn how an app really works. See the Burp Suite tool page; the Community edition is free, the scanner is part of paid editions.
Where to practise
Use targets you are allowed to test: a local OWASP Juice Shop or DVWA in your lab, or the free labs of the PortSwigger Web Security Academy. Do not point Burp at other people's sites.
Setup in four steps
- Start Burp and keep the default proxy listener
127.0.0.1:8080. - Use Burp's built-in browser, or configure a separate browser profile to use that proxy.
- Install Burp's CA certificate in that test profile only so HTTPS can be inspected.
- Browse the practice app and watch requests appear in Proxy → HTTP history.
Features to learn first
| Feature | What it is for |
|---|---|
| Proxy → Intercept | Pause a request, edit it, then forward or drop it |
| HTTP history | Review all captured traffic and search it |
| Repeater | Send the same request again and again with changes |
| Decoder | Convert Base64, URL encoding, hex |
| Intruder | Automate variations of a request (limited in Community) |
A first exercise
- Log in to the practice app and find the login request in the history.
- Send it to Repeater, change a parameter and compare responses.
- Note what changes when you alter an ID, a role value or a cookie, and ask whether the server checks authorisation (see broken access control).
Habits that matter
Keep notes and screenshots, work from a project file, and stay inside the lab scope. After manual testing, compare with an automated ZAP baseline scan. Understand the basics in HTTP and HTTPS.
Related tool: Burp Suite
Use techniques only on systems you are authorised to test.