Burp Suite
Intercept, modify, and automate HTTP(S) attacks with Burp Suite — the standard web proxy for CTF web challenges.
Burp Suite
Burp Suite is an intercepting proxy that sits between your browser and the target, letting you inspect and tamper with every HTTP(S) request and response. For web challenges it is the single most important tool — almost every web exploit starts with capturing a request and replaying a modified version of it.
The free Community Edition is enough for the vast majority of CTF work. Its main limitations versus Professional are a throttled Intruder and no built-in active scanner — neither of which you need to win web challenges. For automation, many players prefer the open-source Caido as a lighter alternative, but Burp remains the reference tool.
Install
Burp ships in Kali (apt install burpsuite) or download the latest from
portswigger.net/burp. It
requires a Java runtime, which the official installer bundles.
First-Time Setup
Start Burp and use the embedded browser
Go to the Proxy → Intercept tab and click Open Browser. Burp's built-in Chromium is pre-configured to route through the proxy and trust Burp's CA, so you skip all manual configuration. Use this unless you have a reason not to.
(Manual route) Point your own browser at Burp
Set the browser's HTTP/HTTPS proxy to 127.0.0.1:8080. The
FoxyProxy extension makes toggling this fast.
Install Burp's CA certificate (manual route only)
Browse to http://burp → CA Certificate, download it, and import it into your browser/OS trust store. Without this, HTTPS interception throws certificate errors.
The Tools You Actually Use
Proxy → HTTP history logs every request the browser made — your map of the application. Toggle Intercept on to pause requests mid-flight and edit them before they reach the server (change a hidden field, a cookie, a method). Right-click any request to Send to Repeater/Intruder.
Use Proxy → Match and Replace rules to auto-rewrite headers (e.g. force
an X-Forwarded-For or strip a CSP header) on every request.
CTF Workflows
Extensions Worth Installing
From the BApp Store (Extensions tab):
| Extension | Purpose |
|---|---|
| JWT Editor | Sign/tamper JSON Web Tokens |
| Logger++ | Searchable, exportable request log |
| Param Miner | Discover hidden parameters and headers (cache poisoning, smuggling) |
| Autorize | Automated access-control / IDOR testing |
| Turbo Intruder | Scriptable, very high-speed request engine (great in Community) |
| Hackvertor | In-place encoding/encryption tag transforms |
Burp vs the Alternatives
| Tool | Notes |
|---|---|
| Burp Suite | The standard; richest extension ecosystem |
| Caido | Modern, fast, Rust-based; clean UI, good free tier |
| mitmproxy | Scriptable CLI/Python proxy — ideal for automation in exploits |
| OWASP ZAP | Fully free/open-source; solid automation and scanning |
Checklist
- Launch via Proxy → Open Browser (zero-config interception)
- Browse the app so HTTP history maps the attack surface
- Send interesting requests to Repeater to iterate payloads
- Use Intruder (or
ffuf) to fuzz parameters and IDs - Install JWT Editor, Param Miner, Autorize from the BApp Store
- Use Comparer to distinguish true/false in blind attacks
See Also
- Essential Toolkit — CLI complements (
ffuf,curl,sqlmap) - Web → Recon — mapping the target before you attack
- CyberChef — heavyweight encoding/decoding
Last updated on