Burp Suite

Proxy, Repeater, Intruder, Decoder & shortcuts for web app testing

Burp Suite Cheat Sheet

Burp Suite is the standard web-app proxy for intercepting, modifying, and replaying HTTP/S traffic, plus fuzzing, scanning, and decoding. For authorized testing only.

1. Launch & proxy setup

# Community/Pro is a GUI Java app — start it from the launcher or:
java -jar burpsuite_community.jar
java -jar -Xmx2g burpsuite_pro.jar       # give it more heap for big scans

Default proxy listener: 127.0.0.1:8080. Point your browser there, or use Burp's built-in browser (Proxy → Intercept → Open Browser) which is pre-configured.

Step	Where
Set listener	Proxy → Proxy settings → Proxy listeners
Browser proxy	127.0.0.1:8080 (HTTP + HTTPS)
Trust CA cert	Visit http://burp → CA Certificate → import into browser/OS
Built-in browser	Proxy → Intercept → Open Browser

2. CA certificate (decrypt HTTPS)

# 1. Browse to http://burp while proxying → download "cacert.der"
# 2. Import it as a trusted root CA.
# Convert DER → PEM if a tool needs PEM:
openssl x509 -inform der -in cacert.der -out burp.pem

System-wide trust (Linux example):

openssl x509 -inform der -in cacert.der -out burp.crt
sudo cp burp.crt /usr/local/share/ca-certificates/burp.crt
sudo update-ca-certificates

3. The core tools

Tool	Purpose	Shortcut to send
Proxy	Intercept / view / edit live traffic	—
Repeater	Manually replay & tweak one request	Ctrl+R
Intruder	Automated fuzzing / brute force	Ctrl+I
Decoder	Encode/decode (URL, base64, hex…)	—
Comparer	Diff two responses word/byte	—
Sequencer	Analyze token randomness	—
Logger / HTTP history	Full request log	—
Scanner (Pro)	Automated vuln scan	—

4. Intercept workflow (Proxy)

• Proxy → Intercept → toggle Intercept is on/off.
• Forward sends the held request; Drop discards it.
• Right-click any request → Send to Repeater / Intruder / Comparer.
• HTTP history tab logs everything even while intercept is off.
• Scope it first: Target → Scope → Add your host so you only capture in-scope traffic. Then "show only in-scope items".

5. Repeater

Ctrl+R         Send request to Repeater
Ctrl+Space     Issue (send) the request          # or click "Send"
Ctrl+Shift+U   URL-decode selection
Ctrl+U         URL-encode selection

Edit method, headers, or body in the left pane; read the response on the right. Use the tabs at the top to keep multiple requests side by side.

6. Intruder

Attack types:

Type	Behavior
Sniper	One payload set, one position at a time
Battering ram	Same payload into all positions simultaneously
Pitchfork	Parallel payload sets (set 1 ↔ pos 1, set 2 ↔ pos 2)
Cluster bomb	Every combination of multiple payload sets

Steps: send to Intruder (Ctrl+I) → Positions (mark §insert-points§, choose attack type) → Payloads (list, brute-forcer, numbers, etc.) → Start attack. Sort results by Status and Length to spot the outlier (e.g. a successful login).

7. Decoder & Comparer

• Decoder: paste data, then "Decode as" / "Encode as": URL, HTML, Base64, ASCII hex, Octal, Binary, Gzip. "Smart decode" auto-detects.
• Comparer: send two responses → compare by Words or Bytes to diff blind-injection / login responses.

8. Match & Replace (auto-rewrite)

Proxy → Proxy settings → Match and replace — rewrite every matching request/response on the fly. Common uses:

Type: Request header   Match: ^User-Agent.*$   Replace: User-Agent: AYSEC-test
Type: Request header   Match: (no match)       Replace: X-Forwarded-For: 127.0.0.1

9. Useful shortcuts

Keys	Action
Ctrl+R	Send to Repeater
Ctrl+I	Send to Intruder
Ctrl+Space	Send the current Repeater request
Ctrl+U / Ctrl+Shift+U	URL-encode / decode selection
Ctrl+F	Forward intercepted request
Ctrl+= / Ctrl+-	Next / previous tab

10. Tips

• Always set Target → Scope first and tick "Suppress out-of-scope" so the tool tree and logs stay clean.
• Save a request from HTTP history → Save item → feed it to other tools: sqlmap -r request.txt.
• Use the Repeater to confirm a finding manually before trusting Scanner (Pro).
• Extensions: BApp Store → add Logger++, Autorize, Param Miner, JSON Web Tokens.
• Disable interception during normal browsing (toggle off) and rely on HTTP history; only intercept when you need to tamper with a specific request.

Authorized testing only. Practice on the AYSEC challenges. Related: SQL injection