Test Web Apps with Burp Suite

This skill executes comprehensive web application security testing using Burp Suite's integrated toolset: HTTP traffic interception and modification, request analysis and replay, automated vulnerability scanning, and manual testing workflows. The source frames it around proxy-based testing methodology for systematic discovery and exploitation of web application vulnerabilities.

Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target, the skill's own gate requires: asking the user to state the exact target URL, IP, account, or resource; confirming written authorization and the permitted scope; showing the exact command and its expected effect; and waiting for explicit confirmation in the conversation. Without that confirmation it stays read-only and gives defensive guidance only. It is marked for authorized security assessments, defensive validation, or controlled educational environments, and states that misuse is illegal and strictly prohibited.

The documented workflow moves through six phases: intercepting HTTP traffic through Burp's browser and the Proxy > Intercept tab; modifying requests, with examples such as changing a price or quantity parameter before forwarding; setting a target scope under Target > Site map so only in-scope traffic is tested and reported; using Repeater to resend and vary a captured request; running automated scans (Professional only) at lightweight, fast, balanced, or deep settings; and configuring Intruder attacks with Sniper, Battering ram, Pitchfork, or Cluster bomb attack types and payload positions marked with section symbols.

Use it on a target you are authorized in writing to test, ideally in a sandbox or disposable VM, to intercept and modify HTTP traffic, replay and vary requests in Repeater, run a Burp scan, or fuzz parameters with Intruder.

Do not use it without stated, confirmed written authorization and a defined scope; the skill's own gate blocks proceeding otherwise. It also notes real limits: the Community Edition lacks the automated scanner, some sites block proxy traffic, HSTS or certificate pinning may need extra configuration, and heavy scanning may trigger WAF blocks.

Inputs are Burp Suite Community or Professional, Burp's embedded browser or a browser configured to use its proxy (default listener 127.0.0.1:8080), the Burp CA certificate installed for HTTPS interception, the target URL, and valid credentials for authenticated testing where applicable.

Outputs are intercepted and modified HTTP requests and responses, vulnerability scan reports with remediation advice, HTTP history and site map documentation, and proof-of-concept exploits for identified vulnerabilities. The source's price-manipulation example shows the pattern:

POST /cart HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

productId=1&quantity=1&price=100

The skill works entirely within Burp Suite's own tools: Proxy, Repeater, Intruder, Target scope and site map, the Dashboard scan engine, Decoder, and Comparer. Keyboard shortcuts documented include Ctrl+F (forward), Ctrl+D (drop), Ctrl+R (send to Repeater), Ctrl+I (send to Intruder), and Ctrl+T (toggle intercept), with Cmd equivalents on macOS.

It is for security testers and defenders running authorized web application assessments, and for learners practicing proxy-based testing methodology in a controlled or educational environment.