How to use Burp Suite Community Edition for web app testing. Used personally on TryHackMe rooms.
Burp Suite is the industry standard tool for web application security testing. If you're doing any kind of web hacking — CTFs, bug bounty, or professional pentesting — you need to know Burp Suite. I first used it on TryHackMe and it completely changed how I understood web applications.
Burp Suite is a web application security testing platform made by PortSwigger. It sits between your browser and the internet as a proxy, letting you intercept, inspect, and modify web traffic in real time.
Two versions:
Go to Proxy → Options. Default listener is 127.0.0.1:8080.
127.0.0.1 Port: 8080http://burpsuiteThe Proxy tab lets you intercept requests before they reach the server.
Repeater lets you take a captured request, modify it, and resend it as many times as you want. This is the tool you'll use most.
Intruder automates sending many requests with different payloads. Useful for brute forcing login forms or finding hidden parameters. Note: rate-limited in Community Edition.
Instantly encode/decode Base64, URL encoding, HTML encoding, and Hex. Super useful in CTFs when you find encoded strings.
| Tool | Use Case |
|---|---|
| Proxy → Intercept | Capture and modify requests |
| Proxy → HTTP History | Review all past requests |
| Repeater | Manual testing and modification |
| Intruder | Automated fuzzing and brute force |
| Decoder | Encode/decode Base64, URL, Hex |
| Target → Site Map | Map application structure |
Best starting point: Work through the TryHackMe Burp Suite rooms first, then do the PortSwigger Web Security Academy labs. Both are completely free.
Legal reminder: Only test web applications you own or have explicit written permission to test. Always use TryHackMe, HackTheBox, or your own lab for practice.