The man in your own middle
An intercepting proxy is a small server you run on your own machine that sits between your browser and the target. Configure the browser to send its traffic through the proxy, and the flow changes: instead of going straight to the server, every request now passes through the tool first, and every response passes back through it on the way home. At any point you can pause a message, read it in full, and rewrite it before releasing it onward.
That single capability breaks an illusion most users never question — the idea that the browser is in charge. The browser is just a convenient client. It enforces nothing the server does not re-check. The previous lesson described the raw HTTP request and response as text: a method, a path, headers, and a body. The proxy is where that text stops being theory. You see the literal bytes, and you get to edit them. A field the page made read-only, a hidden form value, a price the JavaScript "validated" — all of it is just text passing through your hands.
Getting Burp in the path
Burp does nothing until your browser's traffic actually flows through it. Two pieces of setup make that happen. First, point the browser at Burp's proxy listener, which by default listens on 127.0.0.1:8080 — your own machine, port 8080. Once the browser is configured to use that address as its HTTP proxy, every request it makes lands in Burp before it goes anywhere else.
Second, deal with HTTPS. Because Burp is intercepting and re-signing encrypted traffic, the browser will refuse to trust it until you install Burp's CA certificate into the browser's trust store. Skip this step and every HTTPS site throws certificate warnings; complete it and Burp can read and modify encrypted traffic as cleanly as plaintext. This is the same trust mechanism that protects you on the open internet — here you are deliberately telling your browser to trust your own proxy.
With traffic flowing, Burp starts building a picture of the application on its own. As you click around, the Target tab fills in a site map — a tree of every host, path, and endpoint your browsing has touched, complete with the requests and responses behind each one. You are not just generating traffic; you are mapping the attack surface for free, simply by using the app the way a normal user would.
The toolset inside Burp
Burp is not one tool but a suite of them sharing a single captured stream of traffic. A request you catch in the Proxy can be sent, with one keystroke, to any of the others. Learning Burp is really learning which tool to reach for, and the division of labor is clean:
| Tool | What it does | When you reach for it |
|---|---|---|
| Proxy | Intercepts live requests and responses so you can read and modify them in flight before they continue. | Always on — the front door. Catch a request, tamper with a header or parameter, forward it. |
| Repeater | Sends one request over and over, letting you tweak it by hand and watch how the response changes each time. | The workhorse of manual testing. When you want to probe a single endpoint carefully — one variable at a time. |
| Intruder | Automates a request against payload sets, firing many variations at chosen positions. | Fuzzing, brute force, and enumeration — anything that needs volume rather than precision. |
| Comparer | Performs a word- or byte-level diff between two responses. | Spotting the subtle difference between a valid and an invalid login, or a true and false condition. |
| Decoder | Encodes and decodes data — URL, Base64, HTML, hex — and computes hashes. | Untangling an encoded token or parameter, or crafting an encoded payload by hand. |
| Scanner | Pro only — automated vulnerability detection across the site map. | Broad first-pass coverage on an authorized target, to surface the obvious before you dig in by hand. |
The pairing to internalize early is Proxy to Repeater to Intruder. You catch an interesting request in the Proxy, send it to Repeater to understand exactly how the endpoint behaves under careful manual changes, and once you know what a successful or interesting response looks like, hand it to Intruder to repeat that test across hundreds or thousands of payloads. Comparer and Decoder are the support tools you lean on along the way.
Scope and discipline
Burp's power cuts both ways, and the safeguard is scope. Before you do anything else on an engagement, you define the target scope — the exact hosts and paths you are authorized to touch — so that you only ever interact with systems you are allowed to test. Scope is not a convenience setting; it is the technical expression of your authorization.
Scope also stops Burp from misbehaving on your behalf. A modern web page pulls in fonts, analytics, ad networks, and third-party APIs, and without scope set, Burp's automated features can happily fire requests at all of them. Firing tooling at an out-of-scope or third-party system is at best noise and at worst an unauthorized attack against someone who never agreed to be tested. Setting scope tightly — and telling Burp to stay inside it — keeps your traffic where it belongs.
And remember what Intercept actually is: a modified request can break things. Change the wrong value and you may corrupt data, trip an error, or take down a fragile endpoint. The tool does not know or care whether an action is safe — that judgment is yours, governed by the rules of engagement you agreed to before touching the target.
Where the proxy leads
Everything that follows in this phase runs through this lens. Burp is how you see the attack surface — the raw requests, the hidden parameters, the trust the application misplaces in its client — and how you manipulate it once you have found a weak point. Injection, broken access control, authentication flaws, request tampering: nearly every web attack you will practice is, mechanically, a request you caught in the Proxy and reshaped in Repeater or Intruder. Get fluent with the proxy now and the rest of the phase becomes a matter of knowing what to change rather than how.
Burp is not the only intercepting proxy. OWASP ZAP is the open-source alternative — free, fully featured, and built on the same core idea of sitting between browser and server. The next lesson takes it up directly, both as a tool in its own right and as the automation-friendly counterpart to Burp. And the volume testing that Intruder makes possible is pushed much further later in the phase by dedicated fuzzers like ffuf, purpose-built to throw enormous wordlists at an endpoint faster than any general-purpose tool.