Burp Suite for Beginners: Intercepting Your First Request

What Burp Suite Is and How It Fits In

Burp Suite is the de facto standard tool for web application security testing. At its heart it is an intercepting proxy: it sits between your browser and the internet, lets you see every request and response, and lets you modify them before they are sent.

The Community edition is free and perfectly sufficient for learning. It includes the proxy, the repeater for replaying requests, and the decoder for manipulating data, which is everything a beginner needs.

Use it only on traffic that belongs to you: local lab applications, your own servers, or targets within an authorized bug bounty scope. Only test systems you own or have written permission to test.

docker run --rm -p 3000:3000 bkimminich/juice-shop
# a local Juice Shop instance is the perfect first interception target

Setting Up the Proxy in Three Steps

Install Burp Suite Community, then start the built-in browser from the Proxy tab. The built-in browser already has the correct proxy settings, which removes the most common beginner stumbling block.

Burp listens on 127.0.0.1:8080 by default. If you prefer your own browser, set its proxy to that address and install the CA certificate Burp offers, so HTTPS traffic can be decrypted for inspection.

Open any HTTP page while the intercept toggle is on and you will see the request freeze on your screen, ready for inspection or modification.

• •Install Burp Suite Community and accept the defaults
• •Start the built-in browser from the Proxy tab
• •Open a plain HTTP site first to keep things simple
• •Toggle Intercept on and watch requests pause in the proxy

curl -x http://127.0.0.1:8080 http://localhost:3000
# a quick curl through the proxy shows you Burp is listening

Intercepting and Modifying Your First Request

With interception on, load a page in the built-in browser. The request waits in the Intercept tab, showing the method, path, headers, and body. This is the whole point: you now control what the server receives.

Modify something harmless first, like a header value or a query parameter, then click Forward. Observe what the application does with your changed input. Understanding that the server trusts what you send is the seed of every web attack.

Practice changing parameters between requests and watch for differences in responses. The moment a response changes because of something you edited is the moment interception clicks for you.

GET / HTTP/1.1
Host: localhost:3000
User-Agent: Mozilla/5.0

# edit the request in the Intercept tab, then click Forward

Replaying Requests with Repeater

Right-click any intercepted request and send it to Repeater. Repeater lets you replay a request as many times as you like with any edits, which is how you test how an application responds to variations of input.

The classic beginner exercise is parameter tampering: send the request with the original value, then change the value and send again, comparing responses. Slowly changing one thing at a time teaches you exactly which input the application trusts.

Repeater is also where payloads live later in your journey. Once you learn injection and access control attacks, Repeater is the room where you refine them before trusting them on any authorized target.

POST /api/products/search HTTP/1.1
Host: localhost:3000
Content-Type: application/json

{"q":"apple"}
# resend with a modified value and compare the response

Good Habits for Your Burp Journey

Keep interception organized: use a proxy scope so Burp only captures the hosts you care about, otherwise the Proxy tab becomes noise. The scope settings are under Project options and apply to the current session.

Never use Burp against websites that are not yours or not in an authorized program's scope. Interception and replay of traffic on strangers' sites is illegal interception, no matter how curious you are.

Build a personal library of interesting requests and findings as you practice. Replaying, modifying, and understanding traffic is the single most transferable skill in web security, and it all starts with your first intercepted request.