Burp Suite is a swiss-army knife for web security testing. Proxy, scanner, repeater, intruder — tools for every testing phase.

Key Tools¶

• Proxy: Capturing and modifying HTTP requests
• Scanner: Automatic vulnerability detection
• Repeater: Manual testing — repeating and modifying requests
• Intruder: Automated attacks (brute force, fuzzing)
• Decoder: Encoding/decoding (base64, URL, HTML)

Workflow¶

1. Set up browser proxy (127.0.0.1:8080)
2. Browse the application — Burp maps endpoints
3. Scanner finds automatic findings
4. Repeater for manual testing
5. Intruder for parameter fuzzing

Example — IDOR Testing¶

1. Capture request in Proxy¶

GET /api/users/123/profile HTTP/2 Authorization: Bearer eyJ…

2. Send to Repeater¶

3. Change ID: /api/users/456/profile¶

4. If you get 200 → IDOR vulnerability!¶

Key Takeaway¶

Burp Suite Community Edition is free. Proxy + Repeater are your main tools. For automation use Scanner (Pro versions).