How to Set Up Burp Suite: 13 Steps, 90 Min [2026]

Burp Suite pulls roughly 14,800 searches a month on Google, and most of that site visitors is individuals making an attempt to get the proxy operating, not individuals evaluating manufacturers. The instrument sits on the heart of almost each OSCP lab, bug bounty workflow, {and professional} internet app pentest report written in 2026, but the setup nonetheless journeys up newcomers: a lacking CA certificates, a proxy pointed on the fallacious port, or a scanner license that silently caps you at handbook testing solely. This tutorial walks by way of putting in Burp Suite, wiring up the proxy and browser belief chain, operating your first intercepted request, scanning a goal, and constructing a working take a look at venture in opposition to a authorized, disposable app — in 13 steps, about 90 minutes begin to end.

Disclosure and authorized notice: solely run Burp Suite’s proxy, scanner, or Intruder in opposition to purposes you personal, purposes you’ve gotten written permission to check, or purpose-built coaching targets equivalent to OWASP Juice Store and DVWA. Scanning or intercepting site visitors on techniques you don’t management is unlawful in most jurisdictions, full cease.

What Is Burp Suite and Why It’s the Net App Pentesting Commonplace

Burp Suite is an intercepting proxy and testing toolkit constructed by PortSwigger, the identical firm behind the free Net Safety Academy coaching platform. At its core, Burp sits between your browser and the goal internet app, letting you view, pause, and edit each HTTP and HTTPS request earlier than it leaves your machine. That single functionality — full visibility and management over site visitors — is why it turned the default instrument in skilled penetration testing quite than a curiosity.

The toolkit bundles a number of modules underneath one interface: Proxy for intercepting site visitors, Repeater for replaying and tweaking particular person requests, Intruder for automated fuzzing, Scanner for crawling and flagging vulnerabilities, and Decoder/Comparer for encoding and diffing information. Critiques and pentest agency methodology docs revealed by way of 2026 proceed to name it the de facto commonplace for skilled internet software testing and bug bounty work, and it reveals up in almost each trendy OSCP prep course and hands-on lab information as the first proxy instrument.

What makes Burp completely different from simply poking round in a browser’s developer instruments is persistence and management. DevTools reveals you a request after it’s already gone out; Burp enables you to pause it mid-flight, rewrite headers, cookies, or physique parameters, and resend it as many occasions as you need with out triggering a contemporary web page load or re-authenticating. That distinction sounds small till you’re testing a login type or an API endpoint that solely misbehaves on the fourth or fifth crafted request — one thing you’d by no means catch by refreshing a browser tab.

The present launch line is Burp Suite 2026.x. The 2026.1.3 replace added a brand new Uncover tab that centralizes navigation for people who find themselves nonetheless studying the place options dwell, sharper SQL injection detection heuristics within the scanner, SPNEGO help for NTLM authentication (helpful when testing apps sitting behind Home windows-integrated auth), and an improve of the built-in browser’s engine to Chromium 145.x throughout Home windows, macOS, and Linux. A later 2026.4.x level launch patched a high-impact bug within the browser’s crawling engine, which is an effective reminder to all the time seize the most recent construct from PortSwigger’s official release page quite than an older cached installer.

Burp Suite Group vs Skilled vs Enterprise/DAST: 2026 Pricing

Prior to installing something, determine which version suits what you’re doing. The three tiers differ by much more than value — Group is lacking the one characteristic (Scanner) that most individuals affiliate with Burp within the first place.

Group Version provides you the intercepting proxy, Repeater, Decoder, and Comparer totally free, however Intruder is intentionally slowed down and there’s no automated crawler or scanner in any respect — you’re testing the whole lot by hand. That’s a effective trade-off when you’re studying, nevertheless it means each tutorial you discover that reveals “run a scan and get a report in 5 minutes” assumes Skilled.

Skilled is priced at roughly $499 per consumer per 12 months as of 2026, following a worldwide value improve from $449 that took impact on January 6, 2026. That single license unlocks the total scanner, unthrottled Intruder, venture file saving, and Burp AI — a set of assistive options rolled out beginning within the 2025.2 launch that features payload solutions inside Repeater, an “Discover Situation” mode that mechanically chases down scanner findings with follow-up requests, and an “Explainer” that writes a plain-English abstract of a specific request or discovering.

Enterprise, rebranded Burp Suite DAST, is PortSwigger’s team-scale product: centralized dashboards, scheduled and CI/CD-triggered scans, a number of Docker-deployed scanning brokers, and role-based entry. Pricing isn’t revealed; you request a quote, and third-party pricing trackers put entry packages someplace within the low 1000’s per 12 months, scaling towards $19,000+ for bigger deployments. This tutorial focuses on Skilled and Group, since that’s what a person engineer or scholar will really set up.

Conditions and System Necessities

You don’t want a lot to get operating, however a couple of issues will prevent a irritating afternoon later.

• Working system: Home windows, macOS, or Linux, all 64-bit. Trendy Burp installers bundle their very own examined Java runtime, so that you don’t have to handle a separate JRE set up.
• RAM: 8 GB minimal; 16 GB advisable when you’ll run the scanner in opposition to massive single-page apps or preserve a number of venture recordsdata open.
• CPU: a 4-core (or higher) processor retains scans and Intruder assaults from crawling.
• Disk house: a couple of GB free for the installer, plus room for venture recordsdata — massive engagements with full HTTP historical past logging can run into the tens of GB.
• A browser: Burp ships its personal Chromium-based browser (now on Chromium 145.x) pre-trusted to its proxy, which is the simplest path for newbies. You may as well use Firefox or Chrome with handbook proxy and certificates configuration, lined in Step 5.
• A authorized take a look at goal: OWASP Juice Store or DVWA (Rattling Weak Net Software), each free and designed to be attacked. Docker is the quickest solution to stand one up (Step 3 covers this).
• An account with PortSwigger when you’re putting in Skilled — Group wants no account, simply the obtain.

When you’re on a company laptop computer, test together with your safety staff first: many enterprise networks run SSL-inspecting proxies that may battle with Burp’s personal certificates dealing with, which we’ll take care of straight within the troubleshooting part under.

It’s additionally value deciding upfront whether or not you’re putting in this for a one-off studying train or for ongoing paid work. If it’s the latter, finances for Skilled from day one quite than constructing a workflow round Group’s limitations after which having to relearn scanner-driven habits later. The $499/12 months price is trivial subsequent to a single billable engagement, and most freelance pentesters deal with it as a hard and fast price of doing enterprise quite than an non-obligatory improve.

Steps 1–3: Obtain, Set up, and Launch Burp Suite

Step 1: Obtain the proper installer

Go to PortSwigger’s official releases page and seize the most recent 2026.x construct to your OS. Group Version downloads with no account required; Skilled wants you to check in together with your license first. Skip any third-party mirror — there’s no upside to it, and also you lose the assure that the binary hasn’t been tampered with.

Step 2: Set up

On Home windows and macOS, run the graphical installer and settle for the defaults. On Linux, the installer is a self-extracting `.sh` file:

chmod +x burpsuite_pro_linux_v2026_1_3.sh
./burpsuite_pro_linux_v2026_1_3.sh

Comply with the prompts to select an set up listing (`/choose/BurpSuitePro` is the frequent default). The installer writes a desktop launcher and a plain jar file it’s also possible to run straight from a terminal, which issues when you get to headless scanning within the superior suggestions part.

Step 3: Launch and rise up a authorized take a look at goal

Begin Burp. On first launch you’ll be requested to create or open a venture — decide “Momentary venture” whilst you’re studying, and change to a saved venture file when you’re doing actual engagement work you could preserve. On the following display screen, use the “Burp defaults” configuration until you already know you want one thing customized.

Whereas Burp opens, spin up a disposable, legal-to-attack goal in a second terminal. OWASP Juice Store is the quickest possibility through Docker:

docker run --rm -p 3000:3000 bkimminich/juice-shop

That will get you a intentionally weak procuring app at `http://localhost:3000` to apply each approach on this information in opposition to, with none authorized grey space.

Steps 4–6: Configure the Proxy Listener and Belief the CA Certificates

Step 4: Affirm the proxy listener

Open the Proxy tab, then Proxy settings. By default Burp listens on `127.0.0.1:8080`. Depart it there until one thing else in your machine is already sure to that port — whether it is, add a second listener on `127.0.0.1:8081` as an alternative of combating the battle.

Step 5: Select your browser path

You will have two choices right here, and selecting the simple one first will prevent time:

• Burp’s built-in browser (advisable for newbies): click on “Open browser” from the Proxy tab. It’s a Chromium construct that’s already configured to route by way of Burp’s proxy and already trusts Burp’s CA certificates. Site visitors begins flowing with zero additional configuration.
• Your individual browser (Firefox or Chrome): extra versatile for actual engagements the place you want saved logins or particular extensions, nevertheless it requires manually setting the HTTP and HTTPS proxy to `127.0.0.1:8080` within the browser’s community settings, and manually importing Burp’s CA certificates (Step 6).

Step 6: Set up and belief Burp’s CA certificates

When you’re utilizing your individual browser, that is the step nearly everybody will get caught on. Along with your browser’s proxy pointed at Burp, navigate to `http://burp` and obtain the CA certificates from the hyperlink on that web page. Then import it:

1. Firefox: Settings → Privateness & Safety → Certificates → View Certificates → Authorities → Import, and test “Belief this CA to establish web sites.”
2. Chrome/Home windows: import into the Home windows certificates retailer underneath “Trusted Root Certification Authorities.”
3. macOS: drag the cert into Keychain Entry, then double-click it and set “All the time Belief” underneath the Belief part.
4. Linux (system-wide, for instruments that learn the system belief retailer quite than a browser’s personal retailer):

sudo cp cacert.der /usr/native/share/ca-certificates/burp.crt
sudo update-ca-certificates

Restart the browser after importing. When you skip this step, each HTTPS web site will throw a “connection will not be non-public” warning, as a result of so far as your browser is anxious, Burp is now performing a man-in-the-middle on each request — which is, intentionally, precisely what it’s doing.

Step 7: Intercept and Examine Your First HTTP Request

With the proxy and certificates in place, go to Proxy → Intercept and ensure “Intercept is on” is exhibiting. Now go to your Juice Store occasion at `http://localhost:3000` within the browser you configured. The web page will grasp — that’s anticipated. Burp has paused the request earlier than it left your machine.

Swap to Burp and also you’ll see the uncooked request sitting within the Intercept panel, one thing like this:

GET / HTTP/1.1
Host: localhost:3000
Consumer-Agent: Mozilla/5.0 (X11; Linux x86_64)
Settle for: textual content/html,software/xhtml+xml
Connection: shut
Cookie: session=6f2a9c1e...

Click on “Ahead” to let it by way of, or edit any header or parameter straight in that panel earlier than forwarding — that edit-then-forward loop is all the basis of handbook internet app testing. Each request your browser sends now passes by way of this similar checkpoint, and each one lands in Proxy → HTTP historical past, which you’ll be able to search and filter later.

Flip intercept off when you’ve seen the way it works (“Intercept is off” in the identical panel) so you’ll be able to browse usually whereas Burp logs site visitors passively within the background.

Step 8: Use Repeater to Manipulate and Replay Requests

Repeater is the place most handbook testing really occurs. From HTTP historical past, right-click any request — a login POST is an effective first goal — and select “Ship to Repeater.” That opens a devoted tab the place you’ll be able to edit the request and hearth it repeatedly with out re-triggering the entire browser move every time.

Strive a fundamental SQL injection probe in opposition to a login type discipline in Juice Store (once more, this can be a goal constructed particularly to be attacked this manner):

POST /relaxation/consumer/login HTTP/1.1
Host: localhost:3000
Content material-Sort: software/json

{"e-mail":"[email protected]' -- ","password":"something"}

Click on “Ship” and evaluate the response to a traditional login try. Repeater’s cut up view reveals request and response aspect by aspect, and you’ll preserve a historical past of each variation you tried in that tab, which is invaluable whenever you’re documenting a discovering later for a report.

Step 9: Run Burp Scanner for Automated Vulnerability Detection

This step wants Skilled or Enterprise/DAST — Group doesn’t embrace the scanner. Proper-click your goal within the web site map (Goal → Website map) and select “Scan.” Burp will ask whether or not to crawl and audit, or audit solely; for a primary move, let it do each.

The 2026.1.3 scanner ships with noticeably sharper SQL injection heuristics than earlier builds, plus AI-assisted false-positive discount particularly for damaged entry management findings, which was one of many noisiest classes in any scan report. Watch the Dashboard tab for dwell progress and the operating difficulty depend. On a small app like Juice Store, a full crawl-and-audit usually finishes in a couple of minutes; on a big single-page app with heavy client-side routing, finances significantly longer and take into account scoping the crawl to particular paths first.

Findings land underneath the Dashboard’s Points panel, every with a severity score, an outline, the precise request/response that triggered it, and (with Burp AI enabled) an auto-generated rationalization you’ll be able to lean on when writing up the discovering for a consumer or a bug bounty submission. Scanner protection spans the classes most testers really chase:

These map carefully to the OWASP Top 10, which is value holding open in a tab whilst you triage outcomes, because it provides you the usual language to explain severity and affect in a report.

Steps 10–11: Lengthen Burp With BApp Retailer Instruments and Run Intruder

Step 10: Set up extensions from the BApp Retailer

Open the Extensions tab, then BApp Retailer, and seek for these first — they cowl gaps the built-in scanner doesn’t, and so they’re those that preserve exhibiting up in 2026 pentest workflow write-ups:

Click on “Set up” subsequent to any of those straight from the BApp Retailer tab; no separate obtain or restart wanted in present builds.

Step 11: Run Intruder for fuzzing and brute-force testing

Ship a request to Intruder the identical method you despatched one to Repeater. Mark the parameter you need to fuzz (a username discipline, for instance) by highlighting it and clicking “Add §” to wrap it in payload markers, then load a payload checklist underneath the Payloads tab. A brief instance wordlist for testing username enumeration:

admin
administrator
take a look at
demo
help
data

In Group Version, Intruder is intentionally throttled to a crawl, which is ok for a five-item checklist just like the one above however unusable for actual fuzzing in opposition to a big wordlist. That throttle is the one greatest sensible motive individuals improve to Skilled as soon as they transfer previous studying workouts.

Steps 12–13: Use Burp AI and Export Your Findings Report

Step 12: Strive Burp AI for sooner triage

When you’re on Skilled 2025.2 or newer, Burp AI is out there straight inside Repeater and the Dashboard. Proper-click a request in Repeater and search for AI-suggested payloads and follow-up exams; on a scanner discovering, use “Discover Situation” to have Burp mechanically chase the vulnerability with further requests and summarize what it discovered, or “Explainer” to get a plain-language writeup of a request/response pair you’ll be able to drop straight right into a report draft. It received’t substitute judgment on edge instances, nevertheless it noticeably cuts the time spent re-explaining a discovering from scratch.

Step 13: Export your findings

From the Dashboard, choose the problems you need to embrace and select “Report chosen points.” Burp generates an HTML or XML export with severity rankings, affected URLs, request/response proof, and remediation recommendation per discovering, which you’ll be able to hand off as-is or paste into your individual report template. For engagements you’ll revisit, additionally save the venture file itself (File → Save venture as) quite than relying solely on the exported report — you’ll need the uncooked site visitors historical past if a consumer disputes a discovering later.

Full Working Mission: Finish-to-Finish Check In opposition to a Weak Demo App

Placing the entire move collectively, right here’s a full session in opposition to OWASP Juice Store that workouts each instrument lined above. Funds about 20 minutes for the primary full move, longer when you cease to learn each response rigorously, which you need to — the purpose of constructing this workflow is sample recognition, not velocity. Every step under maps again to a step quantity earlier within the information, so if one thing doesn’t behave as anticipated, you’ll be able to bounce again to the related walkthrough.

1. Begin the goal: `docker run –rm -p 3000:3000 bkimminich/juice-shop`
2. Launch Burp, open a short lived venture, use the built-in browser.
3. Browse to `http://localhost:3000`, let Burp passively log site visitors in HTTP historical past.
4. Proper-click the location root in Goal → Website map, run a full crawl-and-audit scan.
5. Whereas the scan runs, ship the login POST request to Repeater and manually attempt the SQL injection payload from Step 8.
6. Ship the identical login request to Intruder, mark the e-mail discipline, load a small username wordlist, and run the assault to search for response-length variations that reveal legitimate accounts.
7. As soon as the scan finishes, open the Dashboard, type points by severity, and use Burp AI’s “Discover Situation” on the highest discovering.
8. Set up the JWT Editor extension and examine the session token issued after a profitable login — Juice Store’s token dealing with is a well-documented weak level and a great way to see JWT Editor in motion.
9. Export a findings report protecting the whole lot above.

Working by way of this as soon as, finish to finish, on a disposable Docker container is the quickest solution to construct actual muscle reminiscence with Burp earlier than you level it at something that issues.

Frequent Pitfalls When Setting Up Burp Suite

Many of the friction individuals run into isn’t a Burp bug — it’s considered one of a handful of setup errors that repeat throughout almost each discussion board thread and help ticket. Right here’s what really goes fallacious, within the order newbies are inclined to hit it.

• Forgetting the CA certificates solely. When you’re not utilizing Burp’s built-in browser, each HTTPS web site throws a belief warning till you import and belief the cert (Step 6). That is the one most typical help query in Burp communities.
• Proxying HTTP however not HTTPS. Some browsers allow you to set an HTTP proxy with out mechanically making use of it to HTTPS site visitors. Double-check each fields in your browser’s community settings.
• Fallacious port after altering the listener. When you moved Burp’s listener to 8081 to dodge a battle, however your browser remains to be pointed at 8080, nothing will intercept and also you’ll get generic connection errors with no apparent trigger.
• Assuming Group consists of the scanner. Numerous first-time customers set up Group, comply with a scanning tutorial written for Skilled, and might’t discover the “Scan” button as a result of it isn’t there.
• Working Intruder assaults anticipating Skilled velocity on Group. The throttle is intentional and by design; it’s not a bug, and there’s no config flag to take away it.
• Scanning with out written authorization. Even by accident leaving the browser proxied to Burp whereas searching an actual web site can generate site visitors that appears like reconnaissance. Flip Intercept and passive logging off, or shut Burp, whenever you’re not actively testing a licensed goal.
• Ignoring company SSL inspection. On managed laptops, an organization proxy could already be re-signing HTTPS site visitors, which conflicts with Burp doing the identical factor. You usually have to chain Burp by way of the company proxy quite than round it (see troubleshooting under).

Troubleshooting Burp Suite Points

When one thing breaks mid-session, it’s nearly all the time traceable to considered one of eight recurring causes. Test these earlier than assuming Burp itself is damaged — in apply, a contemporary set up hardly ever is.

Superior Suggestions for Energy Customers

As soon as the fundamentals are second nature, a couple of habits separate a quick, dependable workflow from a sluggish one.

Run Burp headless for CI-style checks or resource-constrained environments by launching the jar straight with a reminiscence flag suited to your machine:

java -Xmx4g -jar burpsuite_pro.jar

Use project-level scope guidelines (Goal → Scope) so the scanner and Logger++ solely ever contact domains you’ve explicitly approved, quite than counting on reminiscence throughout an extended engagement. Save customized Intruder payload units and Repeater collections as venture templates so that you’re not rebuilding frequent assault sequences from scratch on each new consumer. When you’re doing recurring work in opposition to the identical goal structure, write a small Burp Bounty scan profile as soon as and reuse it, as an alternative of relying purely on default scan checks. And when you’re prepping for OSCP or an analogous examination, apply the total Repeater-and-manual-injection workflow on Group first — the examination atmosphere received’t hand you Skilled’s scanner, so handbook fluency is what really will get examined.

A couple of extra habits value constructing early: preserve separate venture recordsdata per consumer or per engagement quite than one large operating venture, since scope creep between shoppers is each a confidentiality danger and a great way to by accident scan the fallacious goal. Use the Comparer instrument greater than most newbies do — diffing two responses aspect by aspect is commonly sooner at recognizing a delicate behavioral distinction (an additional discipline, a modified standing code, a timing inform) than studying each responses in full. And set a keyboard shortcut for “Ship to Repeater,” because you’ll use it dozens of occasions an hour when you’re in an actual testing rhythm; the default is Ctrl+R on most builds, nevertheless it’s value confirming underneath Consumer choices → Keyboard shortcuts if it doesn’t hearth the primary time.

Burp Suite vs OWASP ZAP vs Caido: Which Ought to You Use

Burp isn’t the one intercepting proxy value understanding, and selecting the correct one depends upon finances and the way far into skilled testing you’re.

OWASP ZAP is the apparent alternative if finances is the arduous constraint — it’s genuinely free without end, not free-with-an-upsell, and it holds up effective for coaching and smaller engagements. Caido has picked up a following amongst bug bounty hunters particularly for its cleaner workspace idea and sooner studying curve. However for skilled pentest reporting, OSCP-style examination prep, and entry to the deepest extension ecosystem, Burp Suite Skilled stays the default alternative reviewers and corporations preserve touchdown on by way of 2026.

Testing APIs and Cell Apps with Burp Suite

Net app testing is Burp’s authentic use case, however a rising share of 2026 pentest work is REST and GraphQL APIs with no browser entrance finish in any respect, plus native cell apps that don’t use a system-wide proxy by default. Each are dealt with the identical method when you perceive the setup variations.

For a pure API goal, you don’t want the built-in browser in any respect. Level any API consumer (Postman, Insomnia, or curl with the `-x` flag) at `127.0.0.1:8080` and each name routes by way of Burp precisely like browser site visitors does, exhibiting up in HTTP historical past and obtainable to ship to Repeater or Intruder. A fast curl instance for testing a JSON endpoint by way of the proxy:

curl -x http://127.0.0.1:8080 -k -H "Content material-Sort: software/json" 
  -d '{"question":"{ consumer(id: 1) { e-mail } }"}' 
  http://localhost:3000/graphql

The `-k` flag skips certificates verification on the consumer aspect, which is ok for a fast take a look at however not one thing you’d need in a script you retain round, because it silently defeats the purpose of TLS validation. For repeated API testing, import Burp’s CA cert into your API consumer’s belief retailer as an alternative, the identical method you probably did for a browser in Step 6.

Cell apps want one additional step: an Android emulator or a rooted/jailbroken system set to make use of your machine’s IP and Burp’s port as its Wi-Fi proxy, plus the CA certificates put in as a consumer (or system, on newer Android variations with app-level pinning) certificates. Apps that implement certificates pinning will nonetheless reject Burp’s cert even after it’s trusted on the OS stage; testing these requires a pinning-bypass instrument equivalent to Frida on a construct you’re approved to switch, which is past the scope of this setup information however value understanding about earlier than you assume an app “can’t be intercepted.”

Yet another characteristic value understanding for each API and cell work: Burp Collaborator, PortSwigger’s out-of-band interplay service, which the scanner makes use of mechanically to catch blind SSRF and blind injection bugs that by no means produce a visual response. When you’re testing on an remoted community with no outbound web entry, it’s also possible to self-host a personal Collaborator server, which is a standard requirement in banking and authorities engagements the place sending any site visitors to PortSwigger’s public infrastructure isn’t allowed.

Incessantly Requested Questions

Is Burp Suite Group Version ok to study penetration testing?

Sure, for handbook testing. You get the proxy, Repeater, Decoder, and Comparer totally free, which covers most of what an OSCP-style examination really exams. You’ll solely really feel the boundaries whenever you want the automated scanner or full-speed Intruder for large-scale fuzzing.

What port does Burp Suite use by default?

The proxy listener defaults to `127.0.0.1:8080`. You may add further listeners on different ports underneath Proxy → Choices if that one’s already in use.

Why do I get certificates warnings on each web site after putting in Burp?

Your browser hasn’t trusted Burp’s CA certificates but. Both change to Burp’s built-in browser (already trusted, zero setup) or manually import the certificates from `http://burp` whereas proxied, as lined in Step 6.

Is it authorized to make use of Burp Suite?

The software program itself is authorized to personal and run in every single place it’s bought. What’s unlawful, in most jurisdictions, is utilizing it to intercept, scan, or assault techniques you don’t personal and don’t have specific written permission to check. Keep on with your individual apps, approved consumer engagements, or purpose-built targets like OWASP Juice Store and DVWA.

How a lot does Burp Suite Skilled price in 2026?

Roughly $499 per consumer per 12 months, following a value improve from $449 that took impact on January 6, 2026. Group Version stays free, and Enterprise/DAST pricing is quote-only.

Does Burp Suite work on Mac, Home windows, and Linux?

Sure, all three, and present builds bundle their very own examined Java runtime so that you typically don’t want to put in or handle Java individually.

What’s Burp AI and do I would like it?

Burp AI is a set of assistive options in Skilled 2025.2 and later: payload solutions in Repeater, computerized follow-up testing on scanner findings (“Discover Situation”), and plain-language write-ups of requests (“Explainer”). It’s not required to make use of Burp successfully, nevertheless it noticeably hurries up triage and reporting when you’re working by way of a big difficulty checklist.

Ought to I take advantage of Burp Suite or OWASP ZAP as a newbie?

Both is an inexpensive place to begin. Burp Group teaches you an identical handbook workflow utilized in skilled testing, and most paid programs and certification labs are written round Burp’s interface. ZAP is a stable free-forever various when you’d quite not take into consideration a future improve in any respect.

Can Burp Suite take a look at REST APIs and GraphQL, not simply web sites?

Sure. Level any API consumer or curl command at Burp’s proxy handle the identical method you’d level a browser, and each request reveals up in HTTP historical past able to ship to Repeater, Intruder, or the scanner. No browser is required for pure API targets.

Why isn’t Burp intercepting site visitors from my cell app?

Both the system’s Wi-Fi proxy isn’t pointed at your machine’s IP and Burp’s port, the CA certificates isn’t put in on the system, or the app makes use of certificates pinning, which rejects Burp’s certificates even when it’s in any other case trusted. Pinned apps want a separate bypass instrument equivalent to Frida earlier than Burp can see their site visitors.

Associated Protection

Sofia Lindström

Editor-in-Chief

Sofia Lindström is the Editor-in-Chief at Tech Insider, the place she leads editorial technique and oversees protection throughout AI, cybersecurity, and enterprise know-how. With over a decade in Swedish tech journalism, she beforehand served as know-how editor at Dagens Industri and lined the Nordic startup ecosystem for Breakit. Sofia holds an MSc in Media Expertise from KTH Royal Institute of Expertise and is a frequent speaker at Net Summit and Slush. She is obsessed with making advanced know-how accessible to enterprise leaders.

View all articles