Burp Suite: The Basics: Proxy Fundamentals, Interface Navigation, and Traffic Interception

Introduction

Welcome to my walkthrough of the TryHackMe room Burp Suite: The Basics! This is the forth and final room in the Web Hacking module of the Cyber Security 101 path.

In my previous article, SQL Fundamentals, we shifted focus to the back end, covering relational databases, CRUD operations, clauses, operators, and functions using MySQL. This room pivots one more time, moving away from the database layer and into the tool that ties everything in this module together in practice: Burp Suite, the industry standard framework for intercepting, inspecting, and manipulating web traffic during a penetration test.

If you missed the previous entry in this series, you can catch up on my walkthrough for SQL Fundamentals below.

What we will cover

• What Burp Suite is, and the differences between its Community, Professional, and Enterprise editions
• The core toolset bundled with Burp Suite Community: Proxy, Repeater, Intruder, Decoder, Comparer, and Sequencer
• Installing Burp Suite and navigating the Dashboard, menus, and settings
• Configuring a browser to route traffic through the Burp Proxy using FoxyProxy
• Working with the Target tab, site map, and scope settings
• Trusting the PortSwigger CA certificate for intercepting HTTPS traffic
• A hands-on example attack demonstrating a reflected XSS bypass through the Proxy
• Answers to every question in the room

Room Information

Before we dive into the tasks, here is a quick overview of the room details.

• Room Name: Burp Suite: The Basics
• Path: Cyber Security 101
• Module: Web Hacking
• Topic: Web Proxy Tooling, Burp Suite Architecture, and Traffic Interception
• Difficulty: Easy
• Room Link: TryHackMe — Burp Suite: The Basics

Task 1: Introduction

This room lays the theoretical and practical groundwork for the rest of the Burp Suite series within the Web Hacking module. It walks through what the framework actually is, tours its bundled tools, covers installation, and finishes by exploring navigation and configuration, with the Burp Proxy treated as the centerpiece.

Because this room is meant as a foundation for the more hands on rooms that follow, it leans more heavily on theory than most rooms in this series so far. If you have never opened Burp Suite before, it is worth reading through each task carefully and actually clicking through the interface as you go, since pairing the reading with direct exploration is what makes the fundamentals stick before moving into more advanced material.

Task 2: What is Burp Suite

Burp Suite is a Java based framework built for web application penetration testing, and it has become the industry standard for hands on assessments of web applications, mobile applications, and APIs alike. At its core, Burp Suite captures and allows manipulation of the HTTP and HTTPS traffic flowing between a browser and a web server, a capability that everything else in the framework builds on. Intercepting a request in transit means a tester can route it to different tools within Burp Suite, inspect it, alter it, or hold a response back before it ever reaches the browser.

The framework ships in three editions. Burp Suite Community is the free, non commercial edition this room focuses on. Burp Suite Professional removes Community's restrictions and adds an automated vulnerability scanner, an unrestricted fuzzer and brute forcer, project saving and reporting, an API for tool integration, unrestricted extension support, and access to Burp Collaborator. Burp Suite Enterprise takes a different approach entirely: rather than running manual attacks from a local machine, it lives on a server and continuously scans target web applications on a schedule, similar in spirit to how a tool like Nessus handles automated infrastructure scanning.

Since Professional and Enterprise both require a paid license, the rest of this room (and the walkthrough below) focuses on the feature set available in Burp Suite Community.

Questions and Answers

Which edition of Burp Suite runs on a server and provides constant scanning for target web apps?

Answer:

Burp Suite Enterprise

Burp Suite Enterprise

Burp Suite is frequently used when attacking web applications and __ applications.

Answer:

Mobile

Mobile

Task 3: Features of Burp Community

Even without a Professional license, Burp Suite Community bundles a genuinely useful set of tools. The Proxy is the framework's signature feature, intercepting and modifying requests and responses as they pass between browser and server. Repeater captures a single request and lets you modify and resend it repeatedly, which makes it ideal for crafting payloads through trial and error (such as SQL injection) or probing an endpoint's behavior. Intruder automates sending large volumes of requests, commonly for brute forcing or fuzzing, though Community imposes rate limits that Professional removes.

Decoder handles encoding and decoding captured data or outgoing payloads, and having it built directly into the same workflow as the rest of Burp Suite saves time over reaching for a separate tool. Comparer diffs two pieces of data at the word or byte level, useful for spotting subtle differences between two responses. Sequencer analyzes the randomness of tokens, such as session cookies, which matters because a weakly randomized token generation algorithm can open the door to serious attacks.

Beyond these built in tools, Burp Suite's Java codebase supports extensions written in Java, Python (via Jython), or Ruby (via JRuby). The Extender module loads these extensions, and the BApp Store acts as a built in marketplace for downloading community made ones, some of which (like Logger++, which extends Burp's built in logging) work fine even without a Professional license.

Questions and Answers

Which Burp Suite feature allows us to intercept requests between ourselves and the target?

Answer:

Proxy

Proxy

Which Burp tool would we use to brute-force a login form?

Answer:

Intruder

Intruder

Task 4: Installation

Burp Suite comes pre-installed on the AttackBox, so if you're working from there, this task can be skipped entirely. For other environments, Kali Linux ships with Burp Suite pre-installed as well, and it can be reinstalled from the Kali apt repositories if it's ever missing. On Linux, macOS, or Windows more broadly, PortSwigger provides dedicated installers on the official Burp Suite downloads page, where selecting Burp Suite Community Edition for your operating system starts the download.

Installation follows the standard pattern for each platform: run the executable on Windows, or execute the installer script from a terminal on Linux. Running the Linux installer without sudo installs Burp Suite into ~/BurpSuiteCommunity/BurpSuiteCommunity rather than adding it to your PATH. The installation wizard's default settings are generally safe to accept, though it's worth reviewing each step regardless.

Task 5: The Dashboard

Launching Burp Suite for the first time prompts you to accept the license terms, choose a project type (Community offers limited options here, so clicking Next is enough), and select a configuration, where the default settings suit most situations. Clicking Start Burp opens the main interface, and first time users may see a training screen worth working through when time allows.

Once past setup, the Dashboard organizes itself into four quadrants, read counter-clockwise from the top left. Tasks defines background activity Burp Suite runs automatically, and Community's default "Live Passive Crawl" task, which logs visited pages, is sufficient for this module. The Event log records actions Burp Suite has taken, such as starting the proxy, alongside details about connections made through it. Issue Activity and Advisory are both Professional-only sections that display and elaborate on vulnerabilities found by the automated scanner, and they will generally show nothing in Community.

Throughout the interface, small question mark icons open contextual help windows specific to whatever section you're viewing, and they're worth using any time a feature isn't immediately clear.

Questions and Answers

What menu provides information about the actions performed by Burp Suite, such as starting the proxy, and details about connections made through Burp?

Answer:

Event log

Event log

Task 6: Navigation

Burp Suite's primary navigation runs through the top menu bar, where each available module (Proxy, Repeater, Intruder, and so on) can be selected directly. Once a module is selected, any sub-tabs it exposes appear in a second menu bar just beneath the main one; the Proxy module's Intercept sub-tab is a typical example. Tabs can also be detached into their own separate windows through the Window menu above the module selection bar, and reattached the same way.

A handful of keyboard shortcuts speed up switching between the tabs used most often: Ctrl + Shift + D opens the Dashboard, Ctrl + Shift + T opens the Target tab, Ctrl + Shift + P opens the Proxy tab, Ctrl + Shift + I opens the Intruder tab, and Ctrl + Shift + R opens the Repeater tab.

Questions and Answers

Which tab Ctrl + Shift + P will switch us to?

Answer:

Proxy tab

Proxy tab

Task 7: Options

Burp Suite's configuration splits into two categories. Global (User) settings apply across the entire installation every time Burp Suite starts, while Project settings apply only to the current session, and since Community doesn't support saving projects, any project specific configuration is lost the moment Burp closes.

The Settings window, opened from the Settings button in the top navigation bar, organizes these options through a left hand menu covering search, a type filter for User versus Project settings, and a full category list. Many tools also expose shortcuts straight into their relevant settings category; the Proxy module's own Proxy settings button, for instance, jumps directly to the proxy related section rather than requiring a manual search. Spending some time browsing through the available categories now pays off later, since a fair amount of Burp Suite's flexibility lives in these settings rather than the main interface.

Questions and Answers

In which category can you find a reference to a "Cookie jar"?

Answer:

Sessions

Sessions

In which base category can you find the "Updates" sub-category, which controls the Burp Suite update behaviour?

Answer:

Suite

Suite

What is the name of the sub-category which allows you to change the keybindings for shortcuts in Burp Suite?

Answer:

Hotkeys

Hotkeys

If we have uploaded Client-Side TLS certificates, can we override these on a per-project basis (yea/nay)?

Answer:

yea

yea

Task 8: Introduction to the Burp Proxy

The Burp Proxy is the tool everything else in the framework tends to route through. When a request passes through it, Burp Suite holds it back from reaching the target server, displaying it in the Proxy tab where it can be forwarded, dropped, edited, or sent to another Burp module entirely. Clicking the "Intercept is on" button toggles this behavior off, letting requests pass through uninterrupted while Burp Suite continues logging them in the background.

Beyond raw interception, the Proxy also captures WebSocket traffic, and both regular HTTP history and WebSocket history remain available for retrospective review even after interception is switched off. The Proxy settings panel exposes further control over this behavior: response interception is disabled by default and only triggers on a per-request basis unless explicit rules are configured, while the Match and Replace section uses regular expressions to automatically rewrite specific parts of requests or responses on the fly, such as swapping out a user agent string or altering a cookie value.

Task 9: Connecting through the Proxy (FoxyProxy)

Getting traffic to actually flow through Burp Suite requires configuring a browser to send it there first. This room focuses on Firefox with the FoxyProxy extension, which comes pre-installed on the AttackBox.

FoxyProxy adds a toolbar button that opens its options pop-up, from which the Options page lets you add a new proxy profile. Filling in an IP of 127.0.0.1 and a port of 8080 (with any title you like) and saving creates a profile that, once activated from the FoxyProxy button, routes all browser traffic through Burp Suite. With that profile active and Intercept switched on in the Proxy tab, visiting any site causes the browser to hang while the request sits in Burp Suite's Proxy tab, waiting to be forwarded, dropped, or edited.

It's worth being deliberate about leaving Intercept enabled, since forgetting to switch it off (or forward a held request) will leave the browser stuck indefinitely on every subsequent request.

Task 10: Site Map and Issue Definitions

The Target tab covers more than just scope configuration; it splits into three sub-tabs. Site map builds a tree structure of every page visited while the proxy is active, effectively generating a map of the target application just by browsing it normally, and it's particularly useful for surfacing API endpoints the application quietly calls in the background. Issue definitions provides the full reference list of vulnerabilities Burp Suite's automated scanner checks for, complete with descriptions and references, which is handy even in Community for citing or describing a vulnerability found manually. Scope settings controls which domains and IPs are considered in scope for the current project.

Even without Professional's automated crawling, simply browsing a target application with the proxy active and intercept switched off is enough to populate a useful site map in Community.

Guided Walkthrough: Discovering a Hidden Endpoint via the Site Map

With the lab machine running and the browser proxied through Burp Suite, we browsed every page linked from the homepage at http://TARGET_IP/, letting the Proxy passively log each request in the background.

After visiting the linked pages, one entry in the site map stood out from the rest: a path made up of a seemingly random string of letters and numbers, unlike any of the normal navigation links on the site. Opening that specific site map entry and reviewing its Response tab (or visiting the path directly in the browser) revealed the flag hidden behind it.

Questions and Answers

What is the flag you receive after visiting the unusual endpoint?

Answer:

THM{NmNlZTliNGE1MWU1ZTQzMzgzNmFiNWVk}

THM{NmNlZTliNGE1MWU1ZTQzMzgzNmFiNWVk}

Task 11: The Burp Suite Browser

Rather than manually configuring a regular browser to work with the proxy, Burp Suite also ships a built in Chromium browser that is pre-configured to route through the proxy automatically. Clicking Open Browser in the Proxy tab launches this window, and any traffic generated inside it flows through Burp Suite without any additional setup.

Running Burp Suite as root on Linux (as is the case on the AttackBox) can prevent this browser from starting due to sandboxing restrictions. The safer fix is running Burp Suite under a low privilege user account; the quicker fix is enabling "Allow Burp's browser to run without a sandbox" under Settings, Tools, Burp's browser, though this is disabled by default for good reason and worth using cautiously, since a compromised browser without a sandbox has a more direct path to the rest of the machine.

Task 12: Scoping and Targeting

Logging every single request the proxy sees quickly becomes unmanageable once more than one application is in play, which is exactly what scoping solves. Right-clicking a target in the Target tab's site map and selecting Add To Scope restricts what Burp Suite actively logs and tracks going forward, and Burp Suite will typically prompt to stop logging out of scope traffic entirely, which is worth accepting in most cases.

Scope can be reviewed and adjusted further from the Scope settings sub-tab. It's worth noting that defining a scope alone doesn't stop the proxy from intercepting out of scope traffic; that requires a separate change in the Proxy settings sub-tab, selecting "And URL Is in target scope" under Intercept Client Requests, which ensures the proxy ignores anything outside the defined scope entirely rather than just excluding it from the logs.

Task 13: Proxying HTTPS

Intercepting plain HTTP traffic works out of the box, but TLS enabled sites raise a certificate trust problem: the browser doesn't recognize the certificate Burp Suite presents in place of the real one, and throws a warning rather than completing the connection. The AttackBox has this already resolved, but for a local install, importing the PortSwigger CA certificate into the browser's trusted certificate store fixes it.

With the Burp Proxy active, navigating to http://burp/cert downloads the CA certificate as cacert.der. In Firefox, opening about:preferences, searching for certificates, and opening the Certificate Manager provides an Import option for that downloaded file; checking "Trust this CA to identify websites" during import completes the process. Once imported, TLS enabled sites should load through the proxy without any certificate warnings.

Task 14: Example Attack

With the proxy configured, this task walks through a simplified, real world style example: testing the support form at http://TARGET_IP/ticket/ for reflected Cross-Site Scripting (XSS), where a malicious script is injected into a page in a way that executes, affecting only the person making that specific request.

Guided Walkthrough: Bypassing a Client-Side Filter with the Proxy

Typing a raw script tag payload directly into the Contact Email field triggered a client side filter blocking special characters not normally valid in an email address, which meant the payload never reached the server in a usable form.

Client side filters like this one only run in the browser, which makes them straightforward to route around using the proxy. With Intercept switched on, submitting the form with legitimate placeholder values first (a valid looking email address and a short test query) allowed the submission to pass browser validation.

Submitting this legitimate input let the request reach the Proxy tab before it ever left the browser.

From there, replacing the intercepted email field with the script tag payload and URL encoding the selection with Ctrl + U made the payload safe to transmit inside the request body. Forwarding the modified request delivered the unfiltered payload straight to the server, bypassing the client side check entirely.

Once forwarded, the browser rendered an alert box confirming the script had executed, demonstrating that the server side handling of the email field trusted the client side filter far more than it should have.

Summary & Key Takeaways

That completes Burp Suite: The Basics, and with it, the entire Web Hacking module! Across this module, we went from the anatomy of a URL and raw HTTP messages, through client side JavaScript, into SQL and relational databases, and now into the tool that ties manual web testing together in practice.

Key lessons:

• Burp Suite intercepts and manipulates HTTP and HTTPS traffic between browser and server, with Community, Professional, and Enterprise editions serving progressively more automated and larger scale use cases.
• The bundled toolset (Proxy, Repeater, Intruder, Decoder, Comparer, Sequencer) covers most of what manual web testing requires, even without a paid license.
• Routing browser traffic through the Proxy requires either a manual FoxyProxy configuration or Burp Suite's own built in Chromium browser, and TLS sites additionally require trusting the PortSwigger CA certificate.
• The Target tab's site map builds a picture of an application just from normal browsing, and can surface unusual or hidden endpoints worth investigating further.
• Scoping keeps the Proxy focused on the application actually being tested, both in what gets logged and, with the right setting enabled, what gets intercepted at all.
• Client side filters and validation offer no real protection once a request can be intercepted and edited before it reaches the server, as the room's reflected XSS example demonstrates directly.

That's it for this module, next up is the first room in the Offensive Security Tooling module, Hydra, where we put automated credential brute-forcing into practice against live login services. Click the banner below to check it out!

If you found this walkthrough helpful, consider following me here on Medium to catch the next room analysis in this series.

You can also connect with me and follow my work across other platforms:

• 💼 LinkedIn
• 🐦 X (Twitter)