Burp Suite — Web Vulnerability Testing

How Burp Suite works, what the Community edition can and can't do, and how to start intercepting real web traffic legally.

What it does

Burp Suite is a proxy that sits between your browser and the web app you're testing, letting you intercept, inspect, and modify every request/response — the core tool for web application penetration testing.

Community (free) vs Pro

Community Edition — free forever, includes Proxy, Repeater, and manual testing tools (enough to learn everything)
Professional — adds the automated scanner and is what real pentest teams pay for; not needed while learning

Download Burp Suite Community Free, official PortSwigger Academy Labs built specifically for Burp practice

Getting started

Set your browser's proxy to 127.0.0.1:8080 and install Burp's CA certificate
Open "Proxy → Intercept" and browse a test site (like OWASP Juice Shop) to see requests live
Learn Repeater first — it lets you resend and tweak a single request to test for vulnerabilities

cOmrade tip

PortSwigger's own Web Security Academy labs are designed to be solved with Burp — do those in order rather than randomly testing live websites you don't own.

← Back to cOmrade