Test Web Apps with Burp Suite

Burp Suite Web Application Testing is a skill for executing comprehensive web application security testing through Burp Suite's proxy-based toolset - HTTP traffic interception and modification, request analysis and replay, automated vulnerability scanning, and manual testing workflows - restricted to authorized security assessments, defensive validation, or controlled educational environments. Its core workflow runs six phases: intercepting HTTP traffic through Burp's embedded browser with the intercept toggle on, modifying request parameters before forwarding (price parameters, user IDs, hidden fields like isAdmin=true, quantity values) to test business logic, input validation, and privilege escalation, setting a target scope to filter noise from third-party requests and prevent accidental out-of-scope testing, sending requests to Repeater for manual iterative testing of different input values, running automated vulnerability scans (Professional edition only, ranging from a ~15-minute lightweight pass to a multi-hour deep scan), and configuring Intruder attacks with payload positions and one of four attack types - Sniper (single-position fuzzing), Battering ram (same payload at all positions), Pitchfork (parallel username:password pairs), or Cluster bomb (full combination brute force).

A representative price-manipulation test modifies a cart request before forwarding it:

POST /cart HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

productId=1&quantity=1&price=100

### Modify to:
productId=1&quantity=1&price=1

Use this skill only for authorized security assessments, defensive validation, or controlled educational environments - never against systems without authorization. Community Edition lacks the automated scanner (Professional only), so automated scanning workflows require the paid edition; Community still covers Proxy, Repeater, and limited Intruder. Its operational boundaries require testing only authorized applications, configuring scope to prevent accidental out-of-scope testing, rate-limiting scans to avoid denial of service, and documenting all findings and actions.

Input is a target web application URL, valid test credentials where applicable, and a Burp project with the proxy listener active on 127.0.0.1:8080 and the CA certificate installed for HTTPS interception; output is intercepted and modified HTTP requests/responses, vulnerability scan reports with remediation advice, HTTP history and site-map documentation, and proof-of-concept exploits for identified vulnerabilities. Worked examples include e-commerce price manipulation (modifying a price=9999 parameter to price=1 and completing checkout, showing the server trusts client-provided price), an authentication bypass via a username=admin' OR '1'='1'-- login payload, and information disclosure where changing a productId parameter to an invalid value surfaces a verbose error revealing the underlying framework version. Common test payloads span SQL injection, XSS, path traversal, and command injection strings, alongside troubleshooting guidance for a browser not connecting through the proxy, failing HTTPS interception, slow performance, and requests that aren't being intercepted.

When reviewing Repeater responses for vulnerability indicators, the skill flags error messages revealing stack traces, framework or version disclosure, differing response lengths suggesting a logic flaw, and timing differences suggesting blind injection. Its best practices call for always setting target scope before extensive testing, using Burp's own browser for reliable interception, saving the project regularly, and manually reviewing scan results for false positives rather than trusting the scanner's output as-is.

Security testers and defenders running authorized web application assessments who need Burp's specific proxy-based workflow - intercept, scope, Repeater, scanner, Intruder - covered end to end with concrete parameter-manipulation and payload examples rather than a generic tool overview.