Burp Suite basics: the intercepting proxy

What a proxy does

A proxy is a program that sits in the middle of a connection. Burp Suite is an intercepting proxy for web testing: you point your browser at Burp, and Burp sees every request on its way to the server and every response on its way back. You can read them, pause them, and change them before they continue.

The main tools

Repeater is where most learning happens: you capture a request, send it to Repeater, change one thing (an ID, a field, a header), resend, and watch how the response changes. That loop — change one thing, observe — is the heart of manual web testing.

Setting it up

You run Burp, set your browser (or Burp's built-in browser) to use Burp as its proxy, and install Burp's certificate so HTTPS can be read. The official docs walk through this. In your lab, point it at your DVWA or Juice Shop VM and start watching requests.

Detection and defence

Detection: using a proxy is invisible to the server by itself, but the unusual requests a tester sends through it (odd values, repeated tries, scripts in fields) are what defenders log and alert on. Defence has nothing to do with the proxy and everything to do with the app: validate and sanitise all input, enforce access control on the server, and watch logs for abnormal requests. If the app is built safely, it does not matter that an attacker can see and change requests.