Burp Suite Tutorial – Getting Started With Burp Suite Tool

This tutorial is an in-depth review of the popular web application security and penetration testing tool Burp Suite. Also, learn about the system requirements and installation steps:

Burp Suite is a tool designed to save time spent by every organization’s application security team trying to secure their application by providing a faster approach to software security through an automated scanning of their portfolios.

It is a tool designed to support and speed up efficiency in penetration testing, CI/CD integration in DevOps with a proper reporting system that captures all issues with appropriate remediation for all issues.

It is a very useful tool for testing different applications. The application has features like repeater, intruder, intercept which are very important features for any penetration testing tool.

What Is Burp Suite

What is Burp Suite

Burp Suite

It is an important tool for everyone from the cybersecurity angle. Most especially the penetration tester and those that participate in bug bounty programs. This tool supports the integration of third-party plugins to carry out any other additional task which may not be initially included with the Burp Suite, you can easily customize these plugins to the Burp Suite.

Suggested Reading =>> Web Application Penetration Testing

Enterprise Edition

If you have a very large software team and will need super-fast feedback and wants to achieve DevSecOps then your option will be the Burp Suite Enterprise edition. This tool will help you achieve full visibility of your total security exposure in your enterprise environment.

The tool has the capacity to empower your DevSecOps by reducing security risk with minimal cost. The deployment of this application is very easy with a simplified reporting system.

Burp Suite Enterprise

Professional Edition

If you want to always test, find and exploit vulnerabilities from your application then your option will be Burp Suite Professional Edition. It is not expensive to acquire and you can even request one month trial to use the professional edition.

This automated tool will always save you time and help you optimize your workflow in the CI/CD pipeline, it is designed to test for vulnerabilities on different web applications with the valid results obtained and minimize false positives.

Burp Suite Professional Edition

Community Edition

If you need just a limited set of manual tools for exploring web security and Intercepting web traffic for penetration purposes, then your option will be the Burp Suite Community edition.

Burp Suite Community Edition

Community Edition vs Professional Edition vs Enterprise Edition

The below table explains the differences:

Burp Suite Community EditionBurp Suite Professional EditionBurp Suite Enterprise Edition
The features are limited and it is a manual tool for researchers.This is a number one tool for penetration testers and bug bounty huntersThis is an automated protection tool for organizations and development teams
Web vulnerability scanner is not availableWeb vulnerability scanner is availableWeb vulnerability scanner is available
There is no scannerYou cannot schedule or repeat scansAbility to Scheduled and repeat your scan
This does not scaleThis does not ScaleUnlimited Scalability
This cannot be integrated to CI/CDThis cannot be integrated to CI/CDIt has the ability to integrate to CI/CD
Not an advanced manual toolIt is an advanced manual toolNot an advanced manual tool
It is an essential manual toolNot an essential manual toolNot an essential manual tool
It is free to useThe Plan start from $399 per yearThe Plan start from $5595 per year

Installing Burp Suite

Installing the tool is a straightforward process by simply running the installer and if it’s Burp Suite Enterprise edition or Burp Suite Professional edition, you need to insert the license key that will be provided to you.

If you don’t want to use the Community Edition, you can request one month trial to use the Professional Edition.

=> Click here to Download Burp Suite Community Edition

=> Click here to try Burp Suite Professional Edition for free

=> Click here to try Burp Suite Enterprise Edition for free

System Requirement For Installing Burp Suite

To install Burp Suite, we recommend you to have a system with the configuration of at least 8 GB of memory and 2 CPU. But if you will perform very large amounts of web application penetration testing, then you may need more memory and if possible increase your CPU strength.

The Burp Suite Community edition is very suitable to test the running capacity that your system can handle before upgrading your edition.

Follow these steps to start using this tool:

#1) Selecting a Burp Suite Project

Immediately after completing the installation and activation, the next thing is the startup wizard page that explains how to kick start the program each time you start Burp Suite.

The first thing on the wizard is to select or create a project to work with.

Select one of the following options:

  • Temporary project: Select this option if you only want to do a quick task and do not want to save your work. All working data is held in memory and is removed immediately after you close the tool.
  • New project on disk: Select this option if you intend to start a new project which will store its data in a Burp Suite project file. This file will continue to hold all the data and configuration settings for the project. The saved data increment as you work on Burp Suite.
  • Open existing project: Select this option if you want to reopen an existing project from a Burp Suite project file. You will see all the recently opened projects displayed for your selection.

Selecting a Burp Suite Project

#2) Confirm that your Burp Suite’s proxy listener is Active and Running

The Burp Suite proxy listener intercepts incoming traffic from your web browser when configured properly. The main work this proxy does is the monitoring and intercepting of all web requests and responses from your browser.

Confirm that the listener is very much active and running by clicking on the Proxy tab and then click on the Options tab.

On the Proxy listener interface, you will see the default local IP and port number which is you can decide to Add, Edit, or Remove. Whenever you see the Running check box selected, it confirms the listener is running.

Burp Suite's proxy listener

#3) Proxy Setting Configuration

If you do not want to go through the stress of configuring proxy settings on an external browser, then you can just use the embedded browser which is already pre-configured to work with Burp Suite Proxy.

Click the Proxy tab and click Intercept tab, you will see Burp’s embedded browser, click Open Browser.

The following steps are only needed if you want to use an external browser for manual testing with Burp Suite.

a) Configuring Burp Suite with Firefox

It is very important to configure the Firefox browser in order to use it for testing with Burp Suite.

Follow the below steps to configure your Firefox network settings:

  • Open the Firefox browser and open the Firefox menu, scroll down and select Options.

open the Firefox menu

  • Click on the General menu and go to the Network Settings section and click the Settings button.
  • From the connection settings section, select the Manual proxy configuration.
  • Input the Burp Suite Proxy listener address which has the default into the HTTP Proxy field.
  • Input the Burp Suite Proxy listener port which has the default 8080 into the Port field and check the Also use this proxy for FTP and HTTPS check box.

connection settings

b) Configuring Burp Suite with Chrome

Follow below configuration of Chrome with Burp Suite was done on Windows 10 system:

  • Open Chrome and go to the menu.
  • In the menu, select Settings, scroll down and click on Advance and click on Open your computer’s proxy settings.

computer’s proxy settings

  • Input the Burp Suite Proxy listener address which has the default into the Address field.
  • Input the Burp Suite Proxy listener port which has the default 8080 into the Port field.
  • Turn the Use a Proxy Server to ON.

Address and port

#4) Configuring FoxyProxy with Burp Suite

FoxyProxy is an Extension that removes the painstaking task of configuring proxy settings on a system each time there is a need for it. This small but mighty proxy extension grants access to a very large number of proxies in Firefox and Chrome browsers. What is required from you is to activate this extension in your toolbar and you are set to use proxy on Burp Suite.


edit proxy burp

#5) What to do after browser configuration on Burp Suite

a) Make sure you are certain that the proxy listener is active.

b) Confirm that Burp Suite is running. Open the browser that you configured and go to any HTTP URL do not use HTTPS yet. You will notice that your browser will keep rolling or shows that it’s trying to load your requested page.

The reason for this is that Burp Suite has intercepted the HTTP request the browser is trying to send.


c) Inside Burp Suite click on the Proxy tab and also click on the Intercept tab under the main tabs. Make sure the two tabs are highlighted and you will start seeing all the intercepted requests dropping into the Raw panel.

Proxy and intercept tabs

d) Another thing that you need to do on the Burp Suite is making sure that the Intercept is on button is highlighted before any web request can be intercepted. If the Intercept is off button is clicked the request will be released from Burp Suite.


e) If you check your browser after the intercept is off button is clicked. You will see that the requested page will now load to the screen.

requested page load to the screen

By following the above steps, you get to know the configuration steps for using an external browser with Burp Suite.

Note: Currently, you can only test web applications that are HTTP. If you make an effort to test an HTTPS application, you will observe that the connection is blocked. Therefore, we will advise you that before testing HTTPS applications you install the Burp Suite CA certificate first.

Burp Suite: Good Tool For Vulnerability Scanning

This is one good tool that you can use to carry out vulnerability scanning on your web applications or websites.

This is an automation process that helps the pen-tester to finish a testing task because sometimes the pen-tester may not have enough time to test all parameters of a web request. This will invariably make the pen-tester to be effective and efficient in achieving his target after going through a rigorous process of penetration testing.

It has the capacity to analyze every detail during the scanning process and it will notify you when a vulnerability has been discovered. It will also help you through the process of remediation by providing you with how to resolve it.

Frequently Asked Questions

Q #1) What is Burp Suite used for?

Answer: It is an application that can act as a proxy server to intercept web requests. It is the most popular web application security and penetration tool in the world.

Also Read =>> Security Testing of Web Applications

Q #2) Is Burp Suite A vulnerability scanner?

Answer: Yes, both burp suite enterprise edition and Burp suite professional can be used to scan for vulnerabilities in an application or website.

Q #3) What is Burp testing?

Answer: Burp Suite Professional is one of the most recognized and acceptable penetration testing tools in the world. It is the number one tool for penetration testers and bug bounty hunters.


In this tutorial, we have discussed the different editions of Burp Suite and how you can integrate any of the editions to achieve your purpose.

We have also learned how these editions compare to each other and the system requirements and process of installing Burp Suite.

We have also analyzed few steps to kick-starting the use of Burp Suite. I will advise every security professional who has never used this security automation tool before to start using it because of its global acceptance.

Further reading => How to use Burp Suite for Web Application Security Testing