Typorithm · medium

Burp Suite Workflow

burp-workflowpentestburpproxyfuzzing

Saved on this device

Full lesson · 8 learning steps Open any exercise for focused practice

Step 1 of 8 · intro card

Learn Burp Suite Workflow

Web App Testing

Burp Suite is the standard intercepting proxy for authorized web testing: route the browser through Burp, map endpoints in Target, edit and replay requests in Repeater, fuzz inputs with Intruder, and use the Pro Scanner for automated leads — all within an agreed scope and following the OWASP Web Security Testing Guide.

Burp Suite sits between the browser and the target as an intercepting proxy. With the browser proxied through 127.0.0.1:8080, every request and response is captured so a tester can inspect and modify traffic during an authorized engagement.

The day-to-day workflow is Target to map the application's endpoints, Repeater to modify and replay a single request while observing how the server responds, and Intruder to fuzz one parameter with a payload list and compare results.

The Pro edition adds an automated Scanner, but professional testing treats scanner output as leads to confirm manually. Defenders reduce exposure with input validation, output encoding, strong authentication and authorization, and a WAF as defense in depth.

Proxy the browser through Burp to capture traffic.

Repeater replays one request; Intruder fuzzes a parameter.

Scanner (Pro) gives leads to verify by hand.

# proxy the browser through Burp 127.0.0.1:8080
# Target: map the application
# Repeater: modify and replay requests
# Intruder: fuzz a parameter
# Scanner: automated checks (Pro)

Read the implementation

Connect each part of the code to the concept before you type.

1. Intercepting proxy

Point the browser at Burp's listener so every request passes through and can be inspected — the foundation of authorized manual testing.

# proxy the browser through Burp 127.0.0.1:8080

2. Map the app

The Target tab builds a site map of every endpoint you browse, so you know the in-scope attack surface before probing it.

# Target: map the application

3. Replay requests

Repeater lets you edit a captured request and send it again, the core loop for manually probing one endpoint at a time.

# Repeater: modify and replay requests

4. Fuzz a parameter

Intruder iterates a payload list over a marked position to fuzz inputs and spot anomalies in responses.

# Intruder: fuzz a parameter

5. Automated scan

The Pro Scanner runs automated checks for common flaws; treat its output as leads to verify by hand, not final findings.

# Scanner: automated checks (Pro)

A complete learning loop

Understand

Read the concept map and follow the code breakdown.

Reconstruct

Type the implementation, repair mistakes and work through every recall exercise.

Verify

Use the final check without hints; revisit weak concepts in short practice sessions.