How to Link Tor with Burp Suite

⚠️ Disclaimer: This guide is for authorized security testing only. Use it only on systems you own or have explicit written permission to test — unauthorized access is illegal, and the author accepts no liability for misuse.

How to Route Burp Suite Through Tor (Step-by-Step)

Some bug bounty programs block entire countries at the network level. You can have full permission to test a target and still hit nothing but a timeout, because your IP happens to come from a blocked country. Routing Burp Suite's traffic through Tor solves that problem. It does something else useful too: it hides your real IP address from every request your browser sends during the test.

This isn't a hacking trick. It's a plumbing fix — Burp sends its traffic through Tor instead of straight to the target. Tor is free, it runs across thousands of independent relays, and no single company logs your traffic the way a VPN provider could. Here's exactly how to set the two up together, on Windows or Linux.

Why Routing Burp Through Tor?

Two reasons come up the most: reaching targets that block your country's IP range, and keeping your real IP out of the logs while you test

Note: not every program allows anonymized traffic. Some want a consistent, identifiable source IP for correlating reports. Check your program's rules

What You'll Need

Three things, all free:

• Tor
• Burp Suite, Community or Professional edition
• A proxy-switcher extension for your browser, such as FoxyProxy

Step 1: Get Tor Running and Find Its Port

Download Tor from the official project page before doing anything:

https://www.torproject.org/download/

Here's the detail that trips people up. Tor exposes a SOCKS proxy, a local port other applications can point their traffic at to route it through the Tor network, and that port changes depending on how you launch Tor.

• Open the Tor Browser from its own icon, and it listens on port 9150
• Run the standalone client directly (tor.exe on Windows, tor command on linux) and it listens on port 9050 instead.

Tor Browser was deliberately switched to 9150 so the two can run at the same time without fighting over the same port. Burp needs to point at whichever one you actually have running, so note the port before moving on.

On Windows

Press the Windows key and type tor.exe, then run it.

Wait for the console window to print "Bootstrapped 100% (done): Done" and look for the line reading "Socks listener on 127.0.0.1:9050" just above it.

To confirm the port is actually open, run this in a separate Command Prompt window:

netstat -ano | findstr :9050

netstat -ano | findstr :9050

You should see a line showing 127.0.0.1:9050 in a LISTENING state.

On Linux

Open a terminal and run:

tor

tor

Watch for the same two signals: "Socks listener on 127.0.0.1:9050" and "Bootstrapped 100% (done): Done." Confirm it from a second terminal with:

sudo ss -lntp | grep :9050

sudo ss -lntp | grep :9050

Step 2: Set Up Burp SOCKS Proxy

Open Burp Suite and click Proxy settings.

Burp doesn't talk to Tor on its own. You have to tell it to, one setting at a time.

In the settings panel, go to Network → Connections, then scroll down to SOCKS proxy.

Click Configure, then fill in:

• SOCKS proxy host: 127.0.0.1
• SOCKS proxy port: 9050 (or 9150, if that's the instance you have running)

Also tick Do DNS lookups over SOCKS proxy — without it, DNS queries can leak outside Tor even while the rest of your traffic is protected.

Click OK, then switch Use SOCKS proxy on. Burp's outbound traffic now runs through Tor.

Step 3: Point Your Browser at Burp

Use your regular browser — Firefox, Brave, Chrome — with your normal extensions and sessions. Not the Tor Browser app. Burp handles the Tor routing for you in the background.

Your browser still points at Burp's own listener, the same way it always does. Check that address under Proxy → Proxy settings → Proxy listeners — usually 127.0.0.1:8080

Set FoxyProxy to that same host and port.

Traffic path: browser → Burp (8080) → Tor (9050) → target.

Step 4: Check That It's Working

With everything switched on, open whatismyipaddress.com in your browser.

You should see an IP that isn't yours, ideally labeled as a Tor exit node — that's the address the target site actually sees. If your real IP shows up instead, the SOCKS toggle or a mismatched port in Step 2 or 3 is almost always the reason.

Why Does This Sometimes Stop Working Between Sessions?

Here's a gotcha worth knowing about before it costs you twenty minutes on your next session. Burp remembers whether Use SOCKS proxy was on or off the last time you closed it, completely independent of whether Tor is actually running right now.

That means you can open Burp days later, forget Tor isn't running, and quietly send every request nowhere. Or the reverse happens: Tor is running and you need it, but the toggle got switched off at some point, so Burp sends everything over your normal connection instead. Get in the habit of checking that setting every time you open Burp for a new session, not only the first time you set it up.

Quick Questions

1- Does this make my testing completely anonymous? No. Tor hides your IP address, but logged-in sessions, cookies, and browser fingerprinting can still identify you to the target. Treat this as one layer of operational hygiene, not a cloak of invisibility.

2- Will this slow Burp down a lot? Yes, expect it. Traffic bounces through three Tor relays before it reaches the target, so this setup fits manual testing and recon better than it fits heavy Intruder or scanner runs.

3- Does this only work with Burp? No. Once Tor's SOCKS proxy is listening on 127.0.0.1:9050, any tool that supports a SOCKS5 proxy — for example, curl, sqlmap, ffuf, and most command-line scanners — can point to that same address directly.

If you've hit a case where this setup didn't behave the way you expected, I'd genuinely like to hear what fixed it. The SOCKS and Tor pairing has a way of failing slightly differently depending on the OS and the Burp version.

I hope you found this useful and picked up something new.

Feel free to connect:

Twitter/X: https://x.com/ABAlawsi LinkedIn: https://www.linkedin.com/in/abalawsi Telegram: https://t.me/awsi5