Burp Suite — setup from scratch for bug bounty (Community + Professional)

Quick answer

Burp Suite is the industry-standard HTTP proxy for bug bounty. Minimal setup: install → dedicated Firefox + Foxyproxy on 127.0.0.1:8080 → CA cert imported into Firefox → target scope defined (anti-noise) → 7 essential extensions from the BApp Store. Community vs Pro: rate-limited Intruder, no Scanner, no Collaborator — but enough to start hunting real bugs.

Install — Mac / Linux / Windows

Download from portswigger.net/burp/communitydownload. It needs Java JRE 21+ which comes bundled in the installer.

# Mac
brew install --cask burp-suite

# Linux
chmod +x burpsuite_community_linux_*.sh && ./burpsuite_community_linux_*.sh

# Windows: standard .exe installer

On first launch: Temporary project → Use Burp defaults → start.

Browser config — dedicated Firefox

Rule #1: don't use your main Firefox for hunting. Create a dedicated profile.

# Mac
/Applications/Firefox.app/Contents/MacOS/firefox --no-remote -P

# Linux
firefox --no-remote -P

# Windows
"C:\Program Files\Mozilla Firefox\firefox.exe" --no-remote -P

Create a bug-bounty profile. Install the FoxyProxy Standard extension:

Proxy Type: HTTP
Proxy IP: 127.0.0.1
Port: 8080

Toggle FoxyProxy on when you're about to hunt. Off for normal browsing.

[!warning] Containers / WebSocket Firefox Multi-Account Containers sometimes breaks the proxy for WebSockets. If your target uses WS (chats, live dashboards), disable containers or use Chrome with --proxy-server=127.0.0.1:8080 and --ignore-certificate-errors.

CA cert — the step people skip

Without Burp's CA cert installed, every HTTPS request gives you a "Cert untrusted" error. And many hunters end up manually clicking Always trust on every cert → chaos.

The correct steps

1. With Burp running and the proxy active in Firefox, navigate to: http://burpsuite (yes, no https).
2. Click CA Certificate in the top right → download cacert.der.
3. In Firefox: about:preferences#privacy → Certificates → View Certificates → Authorities → Import...
4. Select cacert.der → check Trust this CA to identify websites → OK.
5. Restart Firefox.

Test: visit https://google.com with the proxy active. If it loads without an error → cert OK.

Chrome (system keychain)

Mac:

sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain cacert.der

Linux:

sudo cp cacert.crt /usr/local/share/ca-certificates/burp.crt
sudo update-ca-certificates

Windows: double-click cacert.der → Install Certificate → Local Machine → Trusted Root Certification Authorities.

Target scope — anti-noise

Beginner mistake #1: leaving Burp on default scope (accepts everything). Result: 5GB of proxy history with CDNs, Google Analytics, doubleclick.net → impossible to search for anything.

Configure scope

Target tab → Scope settings → Use advanced scope control.

Include in scope:
  Protocol: HTTPS
  Host or IP: ^.*\.target\.com$
  Port: ^443$
  File: .*

Exclude from scope:
  Host or IP: .*(google|googleapis|doubleclick|facebook|cloudflare-static).*

Then, under Proxy → Options → Intercept Client Requests and Misc, enable "And URL is in target scope" for all rules.

Logging filter

Proxy → HTTP history → click the filter bar at the top → enable Show only in-scope items. Your history stays clean.

[!tip] Multi-domain scope regex If the program is *.target.com + target.io + app.target-cdn.net: ^.*\.target\.com$|^target\.io$|^.*\.target-cdn\.net$

7 essential BApp Store extensions

Extender → BApp Store. The ones worth it for every hunter:

Installation: BApp Store → search the name → Install. Some require Jython (Extender → Options → Python Environment → Location of Jython JAR).

[!success] Authorize — the IDOR detector Once configured with two sessions (admin/user), it automatically flags endpoints where the user request returns 200 when it should be 403. It detects IDORs without you reviewing request by request. It's the closest thing to a "free scanner" you have in Community.

Base workflow — a day of hunting

1. Start Burp → Temporary project with scope configured
2. Open dedicated Firefox, enable FoxyProxy
3. Browse the target as a normal (logged-in) user
   → Generates proxy history rich in real endpoints

4. Target → Site map → view the tree of discovered URLs
5. Right-click on host → Engagement tools → Discover content
   → Basic spider to find unlinked paths

6. Param Miner → Guess GET/POST params on key endpoints
   → Headers too ("X-Forwarded-Host", "X-Original-URL")

7. Repeater for every suspicious endpoint
   → Manipulate params, IDOR tests, simple SQLi, XSS

8. Authorize: configure a secondary session → sweep for auth issues

9. Intruder on params that show sensitive data
   → Sniper with a wordlist of IDs / hidden params

10. Logger++ with a status 500 and errors filter → leaks

Pro vs Community — what changes

Pro costs ~$449/year. If you already earn bounties regularly, it's worth it for the Scanner + Collaborator + full-speed Intruder. If you're starting out, Community is enough for the first year.

Community alternatives for what's missing

Collaborator → interactsh

# Run your own server
go install -v github.com/projectdiscovery/interactsh/cmd/interactsh-server@latest
interactsh-server -domain mydomain.com

# Local client
interactsh-client

Generates xyz.mydomain.com URLs with DNS/HTTP/SMTP logging for SSRF/XXE OOB.

Scanner → nuclei

nuclei -u https://target.com -severity medium,high,critical
nuclei -l alive.txt -tags ssrf,sqli,xss

Not 1:1 with Burp Scanner but covers many common checks.

Setup gotchas

• HTTPS interception fails: verify the CA cert is imported correctly in the browser. Test with https://google.com before touching the target.
• Mobile apps: install the CA cert in /system/etc/security/cacerts/ (rooted Android) or configure network_security_config.xml (debuggable APKs).
• Proxy chains: if you work with a VPN, make sure the VPN doesn't break the proxy. Some VPNs intercept all TCP traffic.
• Java memory: if Burp gets slow with large projects, edit the .vmoptions: -Xmx4g (4GB heap).
• HTTP/2: Burp 2024+ supports HTTP/2 natively, but some legacy extensions still break — disable HTTP/2 in Project options → HTTP if you see weird bugs.

Hunting checklist — Burp setup

• Burp Community installed and running
• Dedicated Firefox with bug-bounty profile
• FoxyProxy pointing to 127.0.0.1:8080
• CA cert imported into Firefox → test with https://google.com
• Scope configured with the correct target regex
• HTTP history filter enabled for in-scope only
• Extensions installed: Logger++, Param Miner, Authorize, Burp Bounty, JSON Beautifier, Active Scan++, Hackvertor
• Authorize configured with 2 sessions (admin/user)
• Interactsh running if you need OAST without Pro

Related labs

Practice the Burp workflow end-to-end (proxy, scope, intruder, repeater) on real vulnerable apps in the BBLABS labs.