Burp Suite from scratch: a bug bounty tutorial (2026)

Quick answer: Burp Suite is the essential tool for web bug bounty: a proxy that sits between your browser and the server so you can see, intercept and modify every HTTP request. You install it for free (Community edition), configure the browser to route through 127.0.0.1:8080, import its CA certificate to see the HTTPS, and you're ready to hunt with Repeater and Intruder.

What is Burp Suite?

Burp Suite is an intercepting proxy for web security testing, developed by PortSwigger. It sits in the middle of the conversation between your browser and the server: all the HTTP/HTTPS traffic passes through Burp, where you can see it, pause it, edit it and resend it before it reaches its destination.

That's exactly what you need to hack a website: to stop being limited to what the interface lets you do and start talking directly to the server, changing parameters, headers, cookies and request bodies at will.

It is, without question, the central tool of almost every web bug bounty hunter. If you're only going to learn one tool, make it this one.

How to install and configure Burp Suite?

Installation

Download Burp Suite Community Edition (free) from the official PortSwigger website and install it. It needs Java, but the official installer already includes it. Launch Burp and create a temporary project ("Temporary project") with the default settings ("Use Burp defaults").

Configuring the browser proxy

By default, Burp's proxy listens on 127.0.0.1:8080. Confirm it in Proxy → Proxy settings (or Options in older versions): an active listener should appear at that address.

Now you have to tell your browser to send traffic there. Two options:

• Burp's embedded browser (the easiest): in the Proxy → Intercept tab, click "Open Browser". It opens a preconfigured Chromium, without touching anything else.
• Your browser + extension: install FoxyProxy in Firefox/Chrome and create a profile pointing to 127.0.0.1:8080. That way you switch between "Burp proxy" and "direct connection" with one click.

Installing the CA certificate to intercept HTTPS

If you try to browse an HTTPS site with the proxy active, the browser will give you a certificate error. That's normal: Burp needs its own certificate to be able to "open" the encrypted traffic.

1. With the proxy active, visit http://burp in the browser
2. Click "CA Certificate" and download the cacert.der file
3. Import it into your browser as a trusted authority:
   - Firefox: Settings -> Certificates -> Import -> check "trust for websites"
   - Chrome/OS: add it to the "Trusted Root Certification Authorities" store

With Burp's embedded browser, this step is already done. From here on you'll see all the HTTPS traffic in the clear.

The Burp tools you're going to use

Burp is a suite: several tools that work together. These are the ones you'll actually use as a hunter.

Proxy / Intercept

The heart of Burp. In Proxy → Intercept, when you enable "Intercept is on", each request is paused before leaving and you can edit it by hand:

POST /api/login HTTP/1.1
Host: target.com
Content-Type: application/json

{"user":"admin","password":"123456"}

Change whatever you want and hit Forward to send it, or Drop to discard it. In Proxy → HTTP history you have the log of everything that's passed through Burp, even if it wasn't intercepted: it's where you review endpoints, parameters and responses calmly.

Repeater

Your best friend. Repeater lets you resend the same request over and over, modifying it each time, to test hypotheses. Right-click on any request → "Send to Repeater" (or Ctrl+R).

It's where you manually test an IDOR (change an ID and see the response), an authentication bypass or an injection payload. You edit, hit Send, read the response, adjust. The basic cycle of manual hunting lives here.

Intruder

For automating the sending of many requests while varying one part. You mark the payload position with §:

GET /api/users/§1§/profile HTTP/1.1
Host: target.com
Authorization: Bearer YOUR_TOKEN

With a payload of numbers from 1 to 1000, Intruder iterates on its own and tells you which IDs return 200 with data: perfect for discovering an IDOR at scale, fuzzing parameters or testing lists of values. The Community version limits Intruder's speed (throttling); Pro unlocks it.

Decoder and Comparer

• Decoder: encodes and decodes on the fly (Base64, URL, HTML, hex...). Ideal for reading a JWT or deobfuscating a parameter: paste eyJhbGciOi..., decode it and read the payload.
• Comparer: compares two responses byte by byte or word by word. Useful for detecting subtle differences: for example, the response with a valid cookie versus a tampered one.

Essential extensions (BApp Store)

In Extensions → BApp Store you have dozens of extensions. The ones that show up most in a web hunter's arsenal:

• Autorize: automatically tests for authorization flaws (repeats each request with a lower-privilege user's session). Pure gold for IDOR and access control.
• Logger++: advanced, searchable logging of every request.
• Param Miner: discovers hidden parameters and headers that the site accepts but doesn't document.
• JSON Web Tokens: manipulate and attack JWTs directly from Burp.
• Turbo Intruder: ultra-high-speed fuzzing, ideal for race conditions.

Community vs Professional: which do you need?

The obligatory question. The practical difference:

To get started, Community is more than enough. You can learn absolutely everything with the free version. Pro pays off when you already do this seriously and the slow Intruder or the lack of a scanner start costing you real time (and money). Don't buy it on day one.

A real hunting workflow with Burp

How it all fits into a typical session:

1. Launch Burp and open the embedded browser with the proxy active.
2. Browse the application like a normal user (sign up, log in, use the features). Everything gets saved in the HTTP history.
3. Review the history looking for interesting requests: anything with IDs, tokens, file uploads, parameters that smell like a URL (candidates for SSRF) or fields that get reflected on the page (candidates for XSS).
4. Send the suspicious request to Repeater and test your hypothesis by hand: can I change this ID and see someone else's data? That's an IDOR.
5. If you need scale, send it to Intruder to fuzz values.
6. Document the request and response as evidence for your report.

That loop —observe in the history, hypothesis in Repeater, scale in Intruder— is 90% of the job. Internalizing it takes repetition: practice it with the theory in the Academy and by reproducing real flaws in the labs, where every request you intercept corresponds to a genuinely documented bug.

Other Burp tabs worth knowing

Beyond the Proxy/Repeater/Intruder/Decoder quartet, Burp comes with utilities that save you work:

• Target / Site map. As you browse, Burp builds a tree of the whole application: routes, endpoints and discovered parameters. It's your map of the terrain; mark it by scope so you don't get lost on domains you shouldn't touch.
• Sequencer. Analyzes the randomness of tokens (session, password recovery, CSRF). If a token turns out to be predictable, you've got an authentication flaw served up.
• Collaborator (Pro only). An external server that alerts you when the target makes an out-of-band request. It's the way to confirm a blind SSRF or an injection you don't see in the direct response. In Community it's replaced by services like interactsh.
• Scope settings. Define which domains are in scope so Burp ignores the rest: less noise, more focus and zero risk of fuzzing something you shouldn't.

You don't have to master all of them from day one. Start with Proxy and Repeater; you'll pick up the rest when a specific case calls for it.

Typical mistakes when starting with Burp

The stumbles that repeat for everyone who starts out:

1. Leaving Intercept always on. Intercepting every request makes browsing unbearable. Keep it off by default and review the HTTP history; enable Intercept only when you want to pause a specific request.
2. Forgetting the CA certificate. Without it, the HTTPS isn't intercepted and you think Burp "doesn't work". Install it or use the embedded browser.
3. Fuzzing wildly out of scope. Firing Intruder against domains that aren't in the program is the fastest way to get banned. Configure the scope first.
4. Not saving evidence. When you find the flaw, save the request and response right away: they're the proof for your report.

Internalize the workflow calmly and Burp will go from overwhelming to essential. The best way to practice it is on real cases: every BBLABS lab is a request to intercept and a flaw to confirm.

Frequently asked questions (FAQ)

Is Burp Suite legal?
The tool is 100% legal. What matters is what you use it against: you can only intercept and attack systems you're authorized for (a bug bounty program, a contracted pentest or your own labs).

Burp or OWASP ZAP?
ZAP is the free and open alternative, very capable. But Burp is the de facto industry standard and almost all training and writeups assume Burp. Learn Burp first.

Can I do bug bounty with just the Community version?
Yes. Many hunters started (and earned their first bounties) with Community. Pro accelerates, it doesn't enable.

Why doesn't it intercept HTTPS?
Almost always it's the CA certificate not being imported. Repeat the http://burp → download and import cacert.der step, or just use Burp's embedded browser.

Conclusion

Burp Suite is the tool that turns "using a website" into "talking to the server". Install it, configure the proxy on 127.0.0.1:8080, import the CA certificate and learn the Proxy → Repeater → Intruder loop until it's automatic. You don't need the Pro version to get started, nor to know everything at once: you need to practice it with real cases. Internalize the workflow by reproducing labs of real flaws backed by the theory in the Academy, and Burp will stop being an intimidating menu and become an extension of your hands.