Post cover image

August 14, 2026

Burp Suite for Beginners: Learn Proxy, Repeater & Intruder from Scratch

Introduction

By Sajan Bhat

8 min read

Introduction

If you are starting your journey in cybersecurity, ethical hacking, penetration testing, or bug bounty hunting, there is one tool you will come across again and again:

Burp Suite.

At first, Burp Suite can look complicated. There are many tabs, buttons, requests, responses, headers, parameters, and settings.

But don't worry.

You don't need to understand everything at once.

In this article, we will start from the absolute basics and understand what Burp Suite is, how it works, how to install it, and how to use three of its most important tools: Proxy, Repeater, and Intruder.

By the end, you should have a basic understanding of how Burp Suite fits into web application security testing.

Important:_ Burp Suite should only be used on applications you own or systems where you have explicit permission to test._

What Is Burp Suite?

Burp Suite is a web application security testing platform developed by PortSwigger.

In simple words:

Burp Suite allows you to see, capture, modify, and resend the HTTP/HTTPS communication between your browser and a web application.

Normally, when you use a website, the communication happens very quickly.

For example, you visit:

https://example.com/login

You enter your username and password and click Login.

Behind the scenes, your browser sends an HTTP request to the server.

Something similar to:

POST /login HTTP/1.1
Host: example.com
Content-Type: application/x-www-form-urlencoded
username=sajan&password=example123

The server processes the request and sends a response back.

Without a security testing tool, this communication happens almost invisibly.

Burp Suite gives us a way to inspect that communication.

How Does Burp Suite Work?

Think of Burp Suite as a middleman between your browser and the web server.

Normally:

Browser  →  Web Server

With Burp Suite:

Browser  →  Burp Suite  →  Web Server
                ↓
          Inspect / Modify

This is the basic idea behind Burp Suite's Proxy functionality.

You can capture a request before it reaches the server, inspect it, make changes where appropriate, and then forward it.

This is extremely useful during security testing because many vulnerabilities depend on how an application handles modified requests.

Why Do Security Testers Use Burp Suite?

Web applications constantly exchange information.

For example:

Login
Registration
Search
Profile updates
File uploads
Payments
Password changes
API requests

Every one of these actions can generate HTTP requests.

A security tester needs to understand:

  • What information is being sent?
  • Which parameters are being used?
  • Which cookies are present?
  • What headers are being sent?
  • How does the server respond?
  • What happens if a parameter is changed?
  • Is authorization properly enforced?
  • Does the application validate user input?

Burp Suite makes this communication much easier to analyze.

Burp Suite Editions

Burp Suite is available in different editions.

For beginners, the two versions you will commonly hear about are:

1. Burp Suite Community Edition

The Community Edition is free and is a great starting point for learning.

It provides important functionality for practicing web security, including tools such as:

  • Proxy
  • Repeater
  • Decoder
  • Comparer

Some advanced features have limitations compared with the professional edition.

2. Burp Suite Professional

None

Burp Suite Professional is the paid edition and provides additional functionality designed for professional security testing.

It includes more advanced capabilities and automation features.

If you are completely new to Burp Suite, starting with the Community Edition is perfectly reasonable.

How to Download Burp Suite

Always download Burp Suite from the official PortSwigger website.

Official download page:

Burp Suite Downloads — PortSwigger

Choose the version appropriate for your operating system.

Burp Suite supports major platforms such as:

  • Windows
  • Linux
  • macOS

Getting Started With Burp Suite

After installing Burp Suite, open the application.

You will see several different sections.

Don't worry if the interface looks overwhelming.

You don't need to learn every feature immediately.

For beginners, I recommend focusing heavily on these three:Proxy, Repeater, Intruder

These three tools form a very useful foundation for understanding how web applications communicate.

Let's look at each one.

1. Proxy — The Most Important Place to Start

If you are new to Burp Suite, Proxy should be the first tool you learn.

The Proxy allows Burp Suite to sit between your browser and the web application.

Remember:

Browser
   ↓
Burp Suite
   ↓
Web Server

This allows us to observe HTTP requests and responses.

What Is an HTTP Request?

When your browser wants something from a server, it sends a request.

For example:

GET /profile HTTP/1.1
Host: example.com
Cookie: session=abc123

The server then sends a response.

For example:

HTTP/1.1 200 OK
Content-Type: text/html

The response may contain the webpage or data requested by the browser.

Burp Suite lets us see both sides of this communication.

Intercepting a Request

One of the first things you can try in Burp Suite is intercepting a request.

When interception is enabled, Burp Suite can pause a request before it is sent to the server.

You might see something like:

GET /account HTTP/1.1
Host: example.com
Cookie: session=abc123

At this point, you can inspect the request.

You can then choose whether to:

Forward → send the request to the server.

Drop → discard the request.

This simple feature is incredibly useful when learning web security.

What Should You Look At in a Request?

When you capture a request, don't just click Forward immediately.

Start looking at the different components.

Method

Examples:

GET
POST
PUT
DELETE

URL

Look for:

Paths
Parameters
Endpoints

Headers

For example:

Cookie
Authorization
Content-Type
User-Agent
Origin
Referer

Request Body

POST requests and API requests may contain data such as:

{
  "username": "sajan",
  "email": "example@email.com"
}

Understanding these components is one of the most important skills in web security.

2. Repeater — Your Best Friend for Manual Testing

Once you understand Proxy, the next tool you should learn is Repeater.

Repeater allows you to take an HTTP request and send it repeatedly while modifying it.

Think of it like this:

Capture Request
       ↓
Send to Repeater
       ↓
Modify Request
       ↓
Send
       ↓
Observe Response
       ↓
Modify Again
       ↓
Send Again

This is extremely useful for manual security testing.

Why Is Repeater So Useful?

Imagine you find a request like:

GET /profile?id=100

You can send the request to Repeater and study how the application responds.

You might then test different values in an authorized lab or testing environment:

id=100
id=101
id=102

The important part isn't simply changing the number.

The important question is:

Does the application's authorization logic properly control what the current user is allowed to access?

This type of thinking is important when testing for access-control vulnerabilities such as IDOR.

Repeater Is About Asking Questions

When using Repeater, don't think:

"Which payload should I paste?"

Instead, think:

"What happens if I change this?"

For example:

  • What happens if a parameter is removed?
  • What happens if its value changes?
  • What happens if the HTTP method changes?
  • What happens if a header changes?
  • What happens if the request is repeated?
  • Does the server validate the input?
  • Does the response change?

This makes Repeater one of the best tools for developing a security testing mindset.

3. Intruder — Testing Multiple Variations

The third tool we will discuss is Intruder.

Intruder is designed to automate sending requests with different payloads.

Instead of manually changing a value dozens of times, Intruder can help test multiple variations.

For example, imagine a request contains:

username=test

You might want to test a predefined list of usernames in a controlled lab environment.

Intruder can automate this process.

How Intruder Works

The basic workflow looks like:

Capture Request
       ↓
Send to Intruder
       ↓
Choose Parameter
       ↓
Set Payload Position
       ↓
Choose Payload List
       ↓
Start Attack
       ↓
Compare Responses

Intruder can be useful for tasks such as:

  • Testing parameter variations
  • Fuzzing
  • Finding unusual application behavior
  • Testing input validation
  • Controlled authentication testing where explicitly permitted

However, automation should always be used carefully.

A large number of requests can affect an application, trigger defenses, or violate a bug bounty program's rules.

Proxy vs Repeater vs Intruder

A simple way to remember the difference is:

ToolMain PurposeProxyCapture and inspect trafficRepeaterManually modify and resend requestsIntruderAutomate testing with multiple inputs

Or remember it like this:

Proxy     → "Show me the request."
Repeater  → "Let me change it and try again."
Intruder  → "Let me test many variations."

Once you understand this difference, Burp Suite becomes much easier to navigate.

A Simple Burp Suite Workflow

A typical beginner workflow might look like:

Open Browser
      ↓
Configure Burp Proxy
      ↓
Visit Authorized Test Application
      ↓
Capture Request
      ↓
Understand Request
      ↓
Send to Repeater
      ↓
Modify Request
      ↓
Observe Response
      ↓
Use Intruder When Appropriate
      ↓
Analyze Results

This is much better than randomly clicking through Burp Suite.

A Practical Example

Let's imagine you are testing a deliberately vulnerable lab application.

You log into your account.

The browser sends:

GET /profile?id=100

Burp Proxy captures the request.

You inspect it and notice the id parameter.

You send the request to Repeater.

Now you can test how the application handles different values within the authorized lab.

You compare the responses.

If the application exposes another user's information without properly checking authorization, you may have discovered an access-control issue.

Notice the methodology:

Observe
   ↓
Understand
   ↓
Modify
   ↓
Compare
   ↓
Reason

That is much more important than simply knowing where the buttons in Burp Suite are.

Burp Suite Is Not a "Hack Button"

This is something every beginner should understand.

Burp Suite itself does not magically find vulnerabilities.

It is a tool.

A security tester still needs to understand:

  • HTTP
  • Web applications
  • Authentication
  • Authorization
  • Sessions
  • APIs
  • Input validation
  • Business logic
  • Common vulnerabilities

The tool helps you investigate.

Your understanding finds the vulnerability.

What Should You Learn After Proxy, Repeater & Intruder?

Once you are comfortable with these three tools, continue with:

Beginner

  • HTTP fundamentals
  • Cookies
  • Sessions
  • Authentication
  • Authorization
  • Parameters
  • Headers

Web vulnerabilities

  • XSS
  • SQL Injection
  • CSRF
  • IDOR
  • SSRF
  • File Upload vulnerabilities
  • Access Control
  • CORS
  • Business Logic vulnerabilities

Burp Suite

None

Then explore:

  • Target
  • HTTP History
  • Decoder
  • Comparer
  • Sequencer
  • Extensions
  • Scanner features available in your edition

Don't try to master everything in one day.

Where Should You Practice?

One of the best places to practice web application security is PortSwigger Web Security Academy.

It contains intentionally vulnerable applications and guided labs covering a wide range of web security topics.

PortSwigger Web Security Academy

You can learn a vulnerability and immediately practice it in a controlled environment.

For example:

Learn XSS
   ↓
Open XSS Lab
   ↓
Capture Request with Burp
   ↓
Analyze Request
   ↓
Modify Request
   ↓
Understand the Result

This is much more effective than only watching tutorials.

Tips for Learning Burp Suite Faster

1. Don't memorize everything

Understand what each tool does.

2. Practice every day

Even 30–60 minutes of hands-on practice can make a difference.

3. Read requests carefully

Don't immediately focus on payloads.

Understand the request first.

4. Use Repeater frequently

Repeater is excellent for developing manual testing skills.

5. Learn from failed attempts

A request that doesn't work is still useful.

Ask:

Why didn't it work?

6. Practice legally

Use PortSwigger labs, your own applications, CTFs, or authorized bug bounty programs.

Final Thoughts

Burp Suite may look complicated when you open it for the first time.

But once you understand its basic concept, everything starts making more sense.

Remember the three tools we discussed:

Proxy helps you see and intercept HTTP traffic.

Repeater helps you modify and resend requests manually.

Intruder helps you test multiple variations in a controlled and authorized manner.

If you are beginning your journey in web application security, don't try to become an expert in Burp Suite overnight.

Start with:

HTTP
  ↓
Proxy
  ↓
Repeater
  ↓
Intruder
  ↓
Web Vulnerabilities
  ↓
PortSwigger Labs
  ↓
Real-World Authorized Testing

The more requests you analyze, the more naturally web applications will start to make sense.

And eventually, instead of simply seeing:

GET /profile?id=100

you'll start asking:

Why is this parameter here?

How is the server validating it?

Who is authorized to access this resource?

What happens if the application receives something unexpected?

That curiosity is where real web security skills begin. 🔐

Frequently Asked Questions

What is Burp Suite used for?

Burp Suite is a platform used for testing web applications. It allows security testers to intercept, inspect, modify, and resend HTTP/HTTPS requests and analyze application responses.

Is Burp Suite free?

Burp Suite has a free Community Edition and a paid Professional Edition. The Community Edition is sufficient for learning many fundamental concepts.

Which Burp Suite tool should beginners learn first?

Start with Proxy, then learn Repeater, followed by Intruder.

Is Burp Suite difficult to learn?

The interface can look intimidating initially, but learning the tools one at a time makes it much easier.

Can I use Burp Suite for bug bounty hunting?

Yes, Burp Suite is widely used for authorized web application security testing. However, you must always follow the scope and rules of the specific bug bounty program.

Where can I practice Burp Suite?

PortSwigger Web Security Academy provides intentionally vulnerable labs specifically designed for learning web application security.

Conclusion

You don't need dozens of hacking tools to begin learning web security.

Start by understanding how web applications communicate.

Then learn how to capture those communications with Proxy, analyze and modify them with Repeater, and automate controlled testing with Intruder.

Master these fundamentals first.

The advanced techniques will become much easier afterward.

Learn. Practice. Analyze. Repeat. And always hack responsibly.

Let's Connect 🤝

I'm currently learning and documenting my journey in cybersecurity, web application security, and bug bounty hunting.

If you're also interested in cybersecurity, ethical hacking, or web security, feel free to connect with me on LinkedIn.

LinkedIn: https://www.linkedin.com/in/sajan-bhat/