Burp Suite: Web Application Security Testing Guide

# Download from the official website
# https://portswigger.net/burp/releases

# On Linux - install using the standalone installer
chmod +x burpsuite_pro_linux_v2024_x.sh
./burpsuite_pro_linux_v2024_x.sh

# On macOS - use the .dmg installer or Homebrew
brew install --cask burp-suite
# Or for Community Edition:
brew install --cask burp-suite-community

# On Kali Linux (pre-installed)
burpsuite

# Check Java version
java -version

# Install Java 17+ on Ubuntu/Debian
sudo apt update
sudo apt install openjdk-17-jdk -y

# Install Java on macOS
brew install openjdk@17

# Install Java on Fedora/RHEL
sudo dnf install java-17-openjdk -y

# Verify Java is properly configured
java -version
# openjdk version "17.0.x" ...

# Run Burp Suite JAR directly
java -jar /opt/burpsuite/burpsuite_pro.jar

# Run with increased memory allocation (recommended for large projects)
java -Xmx4g -jar burpsuite_pro.jar

# Run with custom temp directory (for large scan data)
java -Djava.io.tmpdir=/tmp/burp -Xmx4g -jar burpsuite_pro.jar

# Launch with a specific project file
java -jar burpsuite_pro.jar --project-file=webapp-audit.burp

# Launch with a configuration file
java -jar burpsuite_pro.jar --config-file=scan-config.json

# Launch with both project and configuration
java -jar burpsuite_pro.jar \
  --project-file=webapp-audit.burp \
  --config-file=scan-config.json

# Create a new project with a specific name
java -jar burpsuite_pro.jar \
  --project-file=new-project.burp \
  --unpause-spider-and-scanner

# Launch with user-level configuration
java -jar burpsuite_pro.jar \
  --user-config-file=user-settings.json

# Run diagnostics to check for issues
java -jar burpsuite_pro.jar --diagnostics

# Disable extensions on startup (troubleshooting)
java -jar burpsuite_pro.jar --disable-extensions

# Test proxy connectivity with curl
curl -x http://127.0.0.1:8080 http://example.com

# Send HTTPS traffic through Burp (after installing CA certificate)
curl -x http://127.0.0.1:8080 --cacert burp-ca.pem https://target.example.com

# Download Burp's CA certificate
curl -o burp-ca.der http://127.0.0.1:8080/cert
# Convert DER to PEM format
openssl x509 -inform DER -in burp-ca.der -out burp-ca.pem

# Install CA certificate on Linux (system-wide)
sudo cp burp-ca.pem /usr/local/share/ca-certificates/burp-ca.crt
sudo update-ca-certificates

# Use wget through Burp proxy
wget --proxy=on -e http_proxy=127.0.0.1:8080 http://target.example.com

# Set proxy for an entire terminal session
export http_proxy=http://127.0.0.1:8080
export https_proxy=http://127.0.0.1:8080
export no_proxy=localhost,127.0.0.1

# Export scan configuration for automation
# In Burp: Burp menu > Configuration Library > Export

# Example scan configuration JSON
cat > scan-config.json << 'EOF'
{
  "scanner": {
    "active_scanning_optimization": {
      "scan_speed": "normal",
      "scan_accuracy": "normal"
    },
    "active_scanning_areas": {
      "sql_injection": true,
      "xss_reflected": true,
      "xss_stored": true,
      "command_injection": true,
      "path_traversal": true,
      "file_upload": true
    },
    "passive_scanning_areas": {
      "headers": true,
      "cookies": true,
      "forms": true,
      "links": true,
      "content": true
    }
  }
}
EOF

# Launch Burp with scanner auto-start
java -jar burpsuite_pro.jar \
  --project-file=scan-project.burp \
  --config-file=scan-config.json \
  --unpause-spider-and-scanner

# Launch Chrome with Burp proxy settings
google-chrome --proxy-server="http://127.0.0.1:8080" \
  --ignore-certificate-errors \
  --user-data-dir=/tmp/burp-chrome

# Launch Firefox with proxy (use FoxyProxy extension for easier management)
firefox -P burp-profile

# Configure proxy with environment variables (for CLI tools)
export http_proxy="http://127.0.0.1:8080"
export https_proxy="http://127.0.0.1:8080"

# Use Python requests through Burp proxy
python3 -c "
import requests
proxies = {'http': 'http://127.0.0.1:8080', 'https': 'http://127.0.0.1:8080'}
r = requests.get('https://target.example.com', proxies=proxies, verify=False)
print(r.status_code)
"

# Route Node.js HTTP traffic through Burp
HTTP_PROXY=http://127.0.0.1:8080 \
HTTPS_PROXY=http://127.0.0.1:8080 \
NODE_TLS_REJECT_UNAUTHORIZED=0 \
node app.js

# Export proxy configuration with intercept rules
cat > proxy-config.json << 'EOF'
{
  "proxy": {
    "intercept_client_requests": {
      "do_intercept": true,
      "rules": [
        {
          "enabled": true,
          "match_type": "domain_name",
          "match_relationship": "matches",
          "match_condition": "target\.example\.com"
        },
        {
          "enabled": true,
          "match_type": "url",
          "match_relationship": "does_not_match",
          "match_condition": "\.(css|js|png|jpg|gif|ico|woff2?)$"
        }
      ]
    },
    "intercept_server_responses": {
      "do_intercept": false,
      "rules": [
        {
          "enabled": true,
          "match_type": "content_type",
          "match_relationship": "matches",
          "match_condition": "HTML"
        }
      ]
    }
  }
}
EOF

# Launch Burp with this proxy configuration
java -jar burpsuite_pro.jar \
  --config-file=proxy-config.json

# Configure scanner via REST API (Professional edition)
# Start a scan against a specific URL
curl -s -X POST "http://127.0.0.1:1337/v0.1/scan" \
  -H "Content-Type: application/json" \
  -d '{
    "urls": ["https://target.example.com"],
    "scope": {
      "include": [
        {"rule": "https://target.example.com/"}
      ],
      "exclude": [
        {"rule": "https://target.example.com/logout"}
      ]
    }
  }'

# Check scan progress
curl -s "http://127.0.0.1:1337/v0.1/scan/1" | python3 -m json.tool

# List all active scans
curl -s "http://127.0.0.1:1337/v0.1/scan" | python3 -m json.tool

# Export scanner results
# In Burp: Target > Site map > right-click > Issues > Report issues
# Supports HTML, XML, and custom formats

# Prepare payload lists for Intruder
# Common usernames
cat > usernames.txt << 'EOF'
admin
administrator
root
user
test
guest
EOF

# Common passwords
cat > passwords.txt << 'EOF'
password
123456
admin
Password1
letmein
welcome
EOF

# Common XSS payloads for fuzzing
cat > xss-payloads.txt << 'EOF'
<script>alert(1)</script>
"><script>alert(1)</script>
'><script>alert(1)</script>
<img src=x onerror=alert(1)>
<svg/onload=alert(1)>
javascript:alert(1)
EOF

# Common SQL injection test payloads
cat > sqli-payloads.txt << 'EOF'
' OR '1'='1
' OR '1'='1'--
" OR "1"="1
1' ORDER BY 1--
1 UNION SELECT NULL--
'; DROP TABLE users--
EOF

# Directory brute-force wordlist
# Use with Intruder Sniper mode on path parameter
cat > dirs.txt << 'EOF'
admin
login
dashboard
api
config
backup
test
debug
EOF

# Full automated launch with project, config, and auto-scan
java -Xmx4g -jar burpsuite_pro.jar \
  --project-file=automated-scan.burp \
  --config-file=scan-config.json \
  --user-config-file=user-prefs.json \
  --unpause-spider-and-scanner

# Launch with custom proxy listener port
cat > custom-listener.json << 'EOF'
{
  "proxy": {
    "request_listeners": [
      {
        "listen_mode": "loopback_only",
        "listener_port": 9090,
        "running": true
      }
    ]
  }
}
EOF

java -jar burpsuite_pro.jar --config-file=custom-listener.json

# Enable the REST API in Burp:
# User options > Misc > REST API > Enable
# Configure the API port (default: 1337)
# Optionally set an API key for authentication

# Launch a new scan via the REST API
curl -s -X POST "http://127.0.0.1:1337/v0.1/scan" \
  -H "Content-Type: application/json" \
  -d '{
    "urls": ["https://target.example.com/app"],
    "scope": {
      "include": [
        {"rule": "https://target.example.com/app/"}
      ]
    },
    "scan_configurations": [
      {"type": "NamedConfiguration", "name": "Crawl and Audit - Fast"}
    ]
  }'
# Returns: {"task_id": "1"}

# Check scan status and progress
curl -s "http://127.0.0.1:1337/v0.1/scan/1" | python3 -m json.tool

# Poll scan status in a script until complete
while true; do
  STATUS=$(curl -s "http://127.0.0.1:1337/v0.1/scan/1" | python3 -c "
import sys, json
data = json.load(sys.stdin)
print(data.get('scan_status', 'unknown'))
")
  echo "Scan status: $STATUS"
  if [ "$STATUS" = "succeeded" ] || [ "$STATUS" = "failed" ]; then
    break
  fi
  sleep 30
done

# Retrieve scan issues (vulnerabilities found)
curl -s "http://127.0.0.1:1337/v0.1/scan/1" | python3 -c "
import sys, json
data = json.load(sys.stdin)
for issue in data.get('issue_events', []):
    i = issue.get('issue', {})
    print(f"[{i.get('severity', 'N/A')}] {i.get('name', 'Unknown')}")
    print(f"  URL: {i.get('origin', '')}{i.get('path', '')}")
    print()
"

# Cancel an active scan
curl -s -X DELETE "http://127.0.0.1:1337/v0.1/scan/1"

# Run Burp Suite in headless mode (no GUI)
java -Djava.awt.headless=true -Xmx4g \
  -jar burpsuite_pro.jar \
  --project-file=headless-scan.burp \
  --config-file=scan-config.json \
  --unpause-spider-and-scanner

# Headless scan with REST API polling script
#!/bin/bash
# headless-scan.sh - Automated headless Burp Suite scan

TARGET_URL="https://target.example.com"
BURP_JAR="/opt/burpsuite/burpsuite_pro.jar"
API_PORT=1337

# Start Burp in headless mode (background)
java -Djava.awt.headless=true -Xmx4g \
  -jar "$BURP_JAR" \
  --config-file=api-config.json &
BURP_PID=$!

# Wait for Burp to start
echo "Waiting for Burp Suite to initialize..."
sleep 30

# Wait for API to become available
until curl -s "http://127.0.0.1:$API_PORT/" > /dev/null 2>&1; do
  sleep 5
done
echo "Burp Suite REST API is ready"

# Launch scan
TASK_ID=$(curl -s -X POST "http://127.0.0.1:$API_PORT/v0.1/scan" \
  -H "Content-Type: application/json" \
  -d "{"urls": ["$TARGET_URL"]}" | python3 -c "
import sys, json
print(json.load(sys.stdin).get('task_id', ''))
")
echo "Scan started with task ID: $TASK_ID"

# Poll until complete
while true; do
  RESULT=$(curl -s "http://127.0.0.1:$API_PORT/v0.1/scan/$TASK_ID")
  STATUS=$(echo "$RESULT" | python3 -c "
import sys, json
print(json.load(sys.stdin).get('scan_status', 'unknown'))
")
  echo "Status: $STATUS"
  if [ "$STATUS" = "succeeded" ] || [ "$STATUS" = "failed" ]; then
    echo "$RESULT" | python3 -m json.tool > scan-results.json
    break
  fi
  sleep 60
done

# Shutdown Burp
kill $BURP_PID
echo "Scan complete. Results saved to scan-results.json"

# Step 1: Set up the project with scope
java -Xmx4g -jar burpsuite_pro.jar \
  --project-file=webapp-assessment.burp \
  --config-file=scope-config.json

# scope-config.json - Define target scope
cat > scope-config.json << 'EOF'
{
  "target": {
    "scope": {
      "advanced_mode": true,
      "include": [
        {
          "enabled": true,
          "protocol": "https",
          "host": "target.example.com",
          "port": "443",
          "file": "/"
        }
      ],
      "exclude": [
        {
          "enabled": true,
          "protocol": "any",
          "host": "target.example.com",
          "port": "any",
          "file": "/logout"
        }
      ]
    }
  }
}
EOF

# Step 2: Manual browsing to build site map
# Use Burp's browser or configure your browser with the proxy
# Browse through all application functionality

# Step 3: Review site map and identify attack surface
# In Burp: Target > Site map > review endpoints and parameters

# Step 4: Run passive scan on captured traffic
# Passive scanning happens automatically on all proxied traffic

# Step 5: Run active scan on specific areas
# Right-click items in site map > "Actively scan this host"

# Step 6: Export findings
# Target > Site map > right-click > Issues > Report issues
# Choose HTML format for client-ready reports

# Import API requests by proxying CLI tools through Burp
# Test REST API endpoints through Burp proxy
curl -x http://127.0.0.1:8080 \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  https://api.example.com/v1/users

# Send POST request through Burp
curl -x http://127.0.0.1:8080 \
  -X POST \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"name": "test", "email": "test@example.com"}' \
  https://api.example.com/v1/users

# Import OpenAPI/Swagger definition
# In Burp: Target > Site map > right-click > "Import from file"
# Supports OpenAPI 2.0/3.0, WSDL, and WADL formats

# Fuzz API parameters with Intruder
# 1. Capture a request in Proxy history
# 2. Send to Intruder (Ctrl+I)
# 3. Mark payload positions in JSON body
# 4. Load appropriate payload list
# 5. Start attack

# Test for IDOR (Insecure Direct Object References)
# Use Intruder Sniper mode with numeric payloads
# on ID parameters: /api/v1/users/PAYLOAD
# Monitor response codes and body lengths for anomalies

# Test authentication endpoints
curl -x http://127.0.0.1:8080 \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{"username": "admin", "password": "test"}' \
  https://api.example.com/v1/auth/login

# GitLab CI example (.gitlab-ci.yml)
cat > .gitlab-ci.yml << 'EOF'
security-scan:
  stage: test
  image: openjdk:17-slim
  script:
    # Start Burp in headless mode
    - java -Djava.awt.headless=true -Xmx2g
        -jar /opt/burpsuite/burpsuite_pro.jar
        --config-file=ci-scan-config.json &
    - sleep 45

    # Launch scan via REST API
    - |
      TASK_ID=$(curl -s -X POST "http://127.0.0.1:1337/v0.1/scan"         -H "Content-Type: application/json"         -d "{"urls": ["$TARGET_URL"]}" |         python3 -c "import sys,json; print(json.load(sys.stdin)['task_id'])")

    # Wait for scan completion
    - |
      while true; do
        STATUS=$(curl -s "http://127.0.0.1:1337/v0.1/scan/$TASK_ID" |           python3 -c "import sys,json; print(json.load(sys.stdin)['scan_status'])")
        [ "$STATUS" = "succeeded" ] || [ "$STATUS" = "failed" ] && break
        sleep 30
      done

    # Check for high/critical severity issues
    - |
      CRITICAL=$(curl -s "http://127.0.0.1:1337/v0.1/scan/$TASK_ID" |         python3 -c "
      import sys, json
      data = json.load(sys.stdin)
      issues = [e['issue'] for e in data.get('issue_events', [])
                if e['issue']['severity'] in ['high', 'critical']]
      print(len(issues))
      for i in issues:
          print(f"  [{i['severity']}] {i['name']}")
      ")
      echo "Critical/High issues found: $CRITICAL"
      [ "$CRITICAL" -gt "0" ] && exit 1
  artifacts:
    paths:
      - scan-results.json
    when: always
EOF

# GitHub Actions example
cat > .github/workflows/security-scan.yml << 'EOF'
name: Security Scan
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  burp-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Java
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 17

      - name: Run Burp Suite scan
        env:
          TARGET_URL: ${{ secrets.TARGET_URL }}
        run: |
          java -Djava.awt.headless=true -Xmx2g \
            -jar burpsuite_pro.jar \
            --config-file=ci-config.json &
          sleep 45
          ./scripts/run-scan.sh "$TARGET_URL"

      - name: Upload scan results
        uses: actions/upload-artifact@v4
        with:
          name: burp-scan-results
          path: scan-results.json
EOF

# Combine Burp Suite with other tools in a workflow

# 1. Discover web servers with Nmap
nmap -sV -p 80,443,8080,8443 target.example.com

# 2. Quick server scan with Nikto
nikto -h https://target.example.com -output nikto-results.txt

# 3. Route sqlmap through Burp for deeper SQL injection testing
# Export a request from Burp (right-click > Copy to file)
sqlmap -r burp-request.txt --proxy=http://127.0.0.1:8080 --batch

# 4. Use Burp Suite for comprehensive web app testing
java -Xmx4g -jar burpsuite_pro.jar \
  --project-file=full-assessment.burp

# 5. Combine Burp findings with Metasploit for exploitation
# Export Burp scan results and import relevant findings into Metasploit