Burp Suite Community Edition: The Ultimate Web Security Guide 2026

If you are pursuing a career in web application security, penetration testing, or bug bounty hunting, you should master one tool above others: Burp Suite.

Often described as the “Swiss Army knife” of a hacker’s toolkit, Burp Suite (developed by PortSwigger) is the industry standard for web vulnerability scanning and manual exploitation. While enterprise corporations pay thousands of dollars annually for the automated “Professional” tier, the free Burp Suite Community Edition remains powerful. It is a foundational starting point for cybersecurity beginners.

In this comprehensive tutorial, we will demystify Burp Suite Community Edition. You will learn how to configure proxy settings, intercept HTTPS traffic, manipulate HTTP headers using the Repeater, launch fuzzing attacks with the Intruder, and execute your first web vulnerability exploit.

1. What is Burp Suite? (The Man-in-the-Middle)

To understand how to use Burp Suite, you must first understand its fundamental architecture. Burp Suite operates as an intercepting Man-in-the-Middle (MitM) Proxy.

Normally, when you click a link in your web browser (like Firefox or Chrome), your browser sends an HTTP request across the internet to the destination web server. The server processes the request and sends the HTML response back to you. It is a two-party system.

When you launch Burp Suite, you interrupt that direct connection.

You configure your browser to send its traffic to Burp Suite first. Burp Suite “pauses” the internet. It catches the HTTP request mid-flight and holds it on your screen. While the request is paused, you can modify the URL parameters, change the cookies, rewrite the HTTP headers, and inject SQL commands before releasing the request and letting it travel to the destination server.

When the server replies, Burp Suite intercepts the response as well, allowing you to scrutinize the source code, API keys, and error messages before the browser renders the page.

Community Edition vs. Professional Edition

Before we begin, it helps to understand the limitations of the free version:

• Community Edition (Free): Includes the core manual tools: The Proxy, the Repeater, the Decoder, the Comparer, and a throttled version of the Intruder. It is designed for manual testing.
• Professional Edition ($400+/year): Includes an advanced automated vulnerability scanner (it hunts for vulnerabilities while you browse), an unthrottled Intruder, and access to custom extensions.

2. Part 1: How to Install Burp Suite Community Edition

Installing Burp Suite is straightforward, and modern installers bundle the necessary Java Runtime Environment (JRE) automatically.

🪟 Windows Installation

1. Navigate to the official PortSwigger website: portswigger.net/burp/communitydownload.
2. Download the standard Windows .exe installer.
3. Execute the installer and follow the standard wizard. The default directory settings are fine.
4. Launch Burp Suite from your Start Menu.

🐧 Linux Installation (Debian/Ubuntu/Kali)

If you are running Kali Linux (the industry standard for penetration testing), Burp Suite is already pre-installed. You can launch it by typing burpsuite in the terminal.

If you are using standard Ubuntu or Debian, you can install it via the terminal:

# Download the .sh installer file from PortSwigger
# (Make sure to download the correct version number)
chmod +x burpsuite_community_linux_v2026_X_X.sh

# Execute the installer with root privileges
sudo ./burpsuite_community_linux_v2026_X_X.sh

Follow the graphical GUI prompt that appears.

🍎 macOS Installation

1. Download the Apple Silicon (M1/M2/M3) or Intel .dmg file from PortSwigger.
2. Open the DMG file and drag the Burp Suite Community Edition icon into your Applications folder.
3. If macOS Gatekeeper blocks the application, navigate to System Settings → Privacy & Security, scroll to the bottom, and click Allow anyway.

The First Launch Sequence

When you open Burp Suite for the first time, it will present you with a wizard:

1. Project Selection: Because you are using the free Community Edition, you cannot save your projects to the disk. You must select “Temporary project” and click Next.
2. Configuration: Select “Use Burp defaults” and click Start Burp.

You are now looking at the Dashboard—your command center for testing.

3. Part 2: Configuring Your Browser Proxy and SSL Certificates

Burp Suite relies on your web browser sending its traffic to it. By default, Burp Suite listens for traffic on your local loopback address at 127.0.0.1 on port 8080.

You must instruct your browser to use this address as a proxy.

Setting Up Mozilla Firefox (The Hacker’s Browser)

Firefox is an excellent browser for penetration testing because it uses its own independent certificate store, preventing you from altering your Windows/macOS operating system’s security settings.

The Manual Method:

1. Open Firefox and navigate to Settings.
2. Scroll to the bottom to Network Settings and click Settings.
3. Select the Manual proxy configuration radio button.
4. In the HTTP Proxy field, type: 127.0.0.1. In the Port field, type: 8080.
5. Check the box that says: “Also use this proxy for HTTPS”.
6. Click OK.

The Pro-Tip Method (FoxyProxy): Manually turning the proxy on and off in the Firefox settings menu is tedious. Penetration testers often use a free Firefox extension called FoxyProxy Standard. You configure 127.0.0.1:8080 once inside FoxyProxy, and then you can toggle Burp Suite on and off with a single click in your browser toolbar.

The SSL/CA Certificate Problem

If you turn on your proxy right now and try to visit https://google.com, your browser will throw a security warning saying: “Warning: Potential Security Risk Ahead. The certificate is invalid.”

Why? Because Burp Suite is acting as a Man-in-the-Middle on your encrypted HTTPS traffic. It is breaking the encryption and signing it with its own certificate. Firefox detects this and blocks the connection.

To fix this, you must tell Firefox to trust Burp Suite’s certificate.

How to Install the PortSwigger CA Certificate:

1. Ensure Burp Suite is running and your Firefox proxy (or FoxyProxy) is turned ON.
2. In Firefox, navigate to this URL: http://burpsuite (Do not use https, and do not add .com).
3. You will see a minimalist webpage. Click the button in the top right corner labeled CA Certificate. This will download a file named cacert.der to your hard drive.
4. Go back to Firefox Settings. Search for “Certificates” and click View Certificates.
5. Navigate to the Authorities tab. Click Import.
6. Select the cacert.der file you just downloaded.
7. Check the box that says: “Trust this CA to identify websites”.
8. Click OK.

You can now intercept, decrypt, and modify secure HTTPS traffic.

4. Part 3: The Core Tools (Proxy, Repeater, Intruder)

Burp Suite is feature-rich, but as a beginner, you will spend most of your time utilizing three tabs.

Tool 1: The Proxy Tab (The Interceptor)

The Proxy tab is where you pause the internet.

1. Navigate to the Proxy tab, and then the Intercept sub-tab.
2. Ensure the button says “Intercept is on” (it should be highlighted blue).
3. In Firefox, visit any website (e.g., http://testphp.vulnweb.com).
4. Your browser will appear to “hang” or load indefinitely. Go look at Burp Suite.

Burp Suite has successfully frozen the HTTP request. You will see the raw, text-based HTTP packet on your screen. It looks like this:

GET / HTTP/1.1
Host: testphp.vulnweb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Firefox/120.0
Accept: text/html,application/xhtml+xml

You are now in control of this packet. You can click into the text box and change the User-Agent to pretend you are on a mobile device, or alter the URL. Once you are done, you have three options:

• Forward: Releases the packet and sends it to the server.
• Drop: Discards the packet. The server never receives it, and the browser connection dies.
• Action: A dropdown menu that allows you to send this request to the Repeater or Intruder tools for deeper analysis.

(Note: Once you understand how Interception works, turn Intercept is off. If you leave it on, you will have to click ‘Forward’ for every background image and script).

Tool 2: The Repeater Tab (The Manual Hacker)

The Repeater is a valuable tool for a manual bug bounty hunter. It allows you to take an HTTP request, save it, and resend it to the server multiple times while tweaking variables, without having to use your web browser.

1. Turn Intercept off.
2. Navigate to the Proxy -> HTTP History tab. This is a chronological log of every request your browser has made.
3. Find a request that has parameters (e.g., search.php?query=dogs). Right-click that request and select Send to Repeater (or use the hotkey Ctrl + R).
4. Navigate to the Repeater tab.
5. You will see your request on the left side of the screen. Change query=dogs to query=cats.
6. Click the orange Send button in the top left.
7. The server’s response (the raw HTML code) instantly appears on the right side of the screen.

The Repeater is where you manually test for SQL Injections (query=dogs' OR 1=1--) and Cross-Site Scripting (XSS) payloads to see how the server’s backend reacts to different characters.

Tool 3: The Intruder Tab (The Automator)

The Intruder is an automated fuzzing and brute-forcing tool. You give it an HTTP request, define an “insertion point,” load a text file containing payloads, and tell it to send them to the server.

• Note: The Community Edition throttles the speed of the Intruder.

How to Execute a Sniper Attack in Intruder:

1. In your HTTP History, find a login request (e.g., POST /login.php with username=admin&password=123).
2. Right-click and select Send to Intruder (Ctrl + I).
3. Navigate to the Intruder -> Positions tab.
4. Burp will automatically highlight variables it finds with green § symbols. Click the Clear § button to remove them.
5. Highlight only the 123 password value, and click Add §. The text should now look like this: password=§123§. This tells Burp to inject payloads here.
6. Navigate to the Payloads tab.
7. Under Payload Options, paste a list of common passwords (e.g., password, admin, 123456, qwerty).
8. Click the Start Attack button.

Burp will open a new window and begin testing the passwords against the server. You must analyze the results. Look at the Status Code and Length columns. If most attempts return a Length of 500 bytes, but the password qwerty returns a Length of 850 bytes and a 302 Redirect Status Code, you have likely found the correct login. The differing length means the server gave you a different page.

5. Part 4: The Decoder and Comparer

While Proxy, Repeater, and Intruder are the main tools, the auxiliary tools are helpful during complex testing.

The Decoder Tab

Modern web applications encode data before sending it over the network to prevent characters like spaces or quotes from breaking the URL. You will frequently encounter encoded data.

If you intercept a cookie that looks like this: cookie=admin%3Dtrue, you can copy it, navigate to the Decoder tab, paste it, and click Decode as -> URL. It will translate it to cookie=admin=true.

You can also use the Decoder to encode your own payloads. If a filter is blocking the word <script>, you can encode it into Base64 (PHNjcmlwdD4=) and inject it, to test how the backend handles encoded inputs.

The Comparer Tab

The Comparer is a visual diff tool. If you send two different SQL injection payloads to a server, and both return large HTML responses, it can be difficult to spot the difference.

You can right-click Response A and click Send to Comparer, then do the same for Response B. Navigate to the Comparer tab and click Words or Bytes. Burp will highlight the lines of code that differ between the two responses, revealing if your injection changed the database output.

6. Part 5: Target Scope and Keeping Traffic Clean

A common mistake beginners make is failing to define a Target Scope.

If you configure Firefox to use Burp Suite, Burp will intercept everything. It will intercept your background web players, your auto-refreshing tabs, telemetry data, and browser extensions. Your HTTP History will become a cluttered log of unrelated requests.

You should explicitly tell Burp Suite to ignore everything except your target.

1. Navigate to the Target -> Site map tab.
2. Browse your target website normally in Firefox for a minute to populate the map.
3. Find your target domain (e.g., http://testphp.vulnweb.com) in the left-hand Site map tree.
4. Right-click the domain and click Add to scope.
5. Burp may pop up a box asking if you want to stop sending out-of-scope items to the Proxy History. Click Yes.
6. Finally, navigate back to Proxy -> HTTP History. Click the grey filter bar at the top (it usually says “Filter: Hiding CSS, image…”). Check the box that says “Show only in-scope items” and click anywhere to apply.

Your history is now clean. You will only see traffic destined for your target, making your analysis easier.

7. Part 6: Practical Execution (Finding Your First Vulnerability)

Let us put the theory into practice and find a vulnerability using Burp Suite. We will hunt for a Reflected Cross-Site Scripting (XSS) vulnerability on a legally authorized testing platform.

1. Ensure Burp Suite is running, Intercept is OFF, and FoxyProxy is routing your traffic.
2. Navigate to the authorized testing ground: http://testphp.vulnweb.com.
3. Find the “Search art” search bar on the left side of the page.
4. Type the word puppies and hit Enter. The page loads and says “Searched for puppies”.
5. Go to Burp Suite -> Proxy -> HTTP History. Find the request to /search.php?test=query.
6. Right-click the request and Send to Repeater.
7. In the Repeater, change the search query parameter from puppies to a JavaScript payload: <script>alert("HACKED")</script>.
8. Click Send.
9. Look at the raw HTML response on the right side. Search the text for the word HACKED.

If you see that the server took your <script> tags and reflected them directly into the HTML of the page without sanitizing or encoding the brackets into < and >, you have discovered an XSS vulnerability. If you right-click the response and select “Show response in browser,” you will see the pop-up alert box execute.

8. Expanding Capabilities: The BApp Store

The Burp Suite Community Edition is highly extensible. The community has written many free plugins that add functionality to the software.

Navigate to the Extensions -> BApp Store tab. Here are three free extensions you might consider installing:

1. Logger++: An advanced, customizable logging tool that offers more features than the default HTTP History tab.
2. Param Miner: Written by PortSwigger’s research team, this tool uses algorithms to discover hidden API parameters that developers forgot to remove.
3. Turbo Intruder: A Python-scriptable alternative to the default Intruder. It bypasses the Community Edition speed limits, allowing you to fire many requests for complex race-condition testing.

9. Crucial Beginner Mistakes to Avoid

Before you begin, review these common pitfalls:

10. Conclusion and Next Steps

Burp Suite Community Edition can be intimidating the first time you open it. The data-heavy interface looks complex.

However, by mastering the core fundamentals—configuring the proxy, manipulating requests in the Repeater, and automating fuzzing with the Intruder—you possess the same foundational skills used by professional bug bounty hunters.

You cannot learn cybersecurity by reading alone. You must practice.

Your Next Steps:

1. Create a free account on the PortSwigger Web Security Academy. It is free, created by the makers of Burp Suite, and contains interactive labs.
2. Complete the “Access Control Vulnerabilities” and “SQL Injection” modules using your Repeater skills.
3. Compare your Burp Suite knowledge with the open-source alternative by reading our OWASP ZAP Beginner Tutorial.
4. Expand your reconnaissance skills by mastering command-line directory brute-forcing in our Gobuster Tutorial.

Frequently Asked Questions (FAQ)

Q: What is Burp Suite Community Edition? A: Burp Suite Community Edition is a free, widely-used web vulnerability scanner and manual exploitation tool. It acts as an intercepting Man-in-the-Middle (MitM) proxy to help you analyze and modify HTTP traffic.

Q: Why do I get a certificate error when intercepting HTTPS traffic with Burp Suite? A: Because Burp Suite breaks the HTTPS encryption to intercept traffic, your browser does not recognize its signature. You must download and install the PortSwigger CA Certificate into your browser to trust the connection.

Q: What is the Burp Suite Repeater tool used for? A: The Repeater tool allows manual bug bounty hunters to take an intercepted HTTP request and resend it to the server multiple times while tweaking variables, making it ideal for testing SQL injections or XSS payloads.

Q: How does the Intruder tool differ in the Community Edition compared to Professional? A: While the Professional Edition includes an unthrottled Intruder, the Community Edition throttles the speed of the Intruder, making automated fuzzing and brute-forcing significantly slower.

Q: How can I prevent Burp Suite from intercepting unrelated background traffic? A: You should define a Target Scope by navigating to the Site map tab, right-clicking your target domain, and adding it to your scope. Then, filter your HTTP History to only show in-scope items.