> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/burp-suite.md).

# Burp Suite

## **What is Burp Suite?**

Burp Suite is a **web security testing tool** developed by [**PortSwigger**](https://portswigger.net/). It functions as an **intercepting proxy**, allowing security testers to **capture, analyze, and modify HTTP/S requests and responses** between a client (such as a web browser or API client) and a web server.

Beyond basic interception, Burp Suite offers various advanced features, including:

* **Web Spidering** – Automatically crawling web applications to map out their structure.
* **Automated Vulnerability Scanning** – Identifying security weaknesses such as **SQL Injection, XSS, CSRF**, and more.
* **Extensibility** – Supporting **pre-built and custom extensions** for enhanced security testing.

***

### **How Burp Suite Work**

**Before Using Burp Suite (Direct HTTPS Communication)**

* The browser establishes a **secure TLS/SSL connection** directly with the web server.
* Traffic is **encrypted**, preventing interception.

```
+------------------+        Encrypted (TLS/SSL)        +-------------------+
|  Web Browser    | <--------------------------------> |  Web Server      |
+------------------+                                   +-------------------+
```

***

**After Using Burp Suite (Intercepting HTTPS Traffic)**

* **Burp Suite generates its own SSL/TLS certificate (Burp CA Key).**
* The browser is configured to **trust Burp’s CA certificate** so it does not show security warnings.
* Burp decrypts and inspects/modifies traffic before re-encrypting it.

```
+------------------+             HTTPS (Encrypted)            +------------+
|   Web Browser    | <-------> | Burp Suite Proxy | <-------> | Web Server |
+------------------+           +-------------------+          +------------+
       |                          | Decrypt Request using Burp CA Key |
       |                          | Modify & Inspect Data            |
       |                          | Encrypt Request with New Key     |
       |                          | Send to Server                   |
       |                          | Decrypt Response from Server     |
       |                          | Encrypt Response using Burp CA   |
```

***

#### **Breakdown of the Process**

1. **Client Request (Before Burp Suite)**
   * The browser sends an **HTTPS request encrypted with the web server’s SSL/TLS certificate**.
   * Normally, no third party can intercept or modify it.
2. **Intercepted by Burp Suite**
   * Burp Suite **presents its own fake TLS certificate (Burp CA Key)** to the browser.
   * Since the user has installed and trusted this **Burp CA certificate**, the browser **believes it is communicating securely with the real server**.
   * Burp **decrypts the request**, allowing inspection/modification.
3. **Forwarding to the Web Server**
   * Burp **re-encrypts** the request using the **real web server's SSL/TLS certificate** and forwards it.
   * The web server processes the request as usual.
4. **Intercepting the Response**
   * The web server responds with an **encrypted HTTPS response**.
   * Burp decrypts it, allowing modification/inspection.
5. **Returning to the Browser**
   * Burp re-encrypts the response using its **Burp CA Key** and sends it to the browser.
   * The browser, trusting Burp’s certificate, accepts the response as if it came directly from the web server.

***

#### **Why is the Burp CA Certificate Important?**

* **Without the Burp CA Certificate**, the browser will detect that the connection has been tampered with and show a **security warning**.
* **Installing Burp’s CA Certificate allows seamless interception** without alerts.

***

### **Burp Suite Editions**

Burp Suite comes in three different editions, catering to various security testing needs:

1. **Burp Suite Community Edition (Free)**
   * Provides basic features such as **manual HTTP interception and request modification**.
   * Lacks automated scanning capabilities.
   * Suitable for **learning, basic security testing, and manual web application testing**.
2. **Burp Suite Professional (Paid)**
   * Includes **advanced tools for manual and automated penetration testing**.
   * Features **Active Scan**, which **automatically detects security vulnerabilities**.
   * Offers additional tools like **Intruder, Repeater, and Collaborator** for **exploitation and deep testing**.
   * Best for **security researchers, penetration testers, and ethical hackers**.
3. **Burp Suite Enterprise (Paid, for Large-Scale Testing)**
   * Designed for **continuous security testing in large organizations**.
   * Supports **automated scans across multiple applications and CI/CD pipelines**.
   * Provides **detailed security reports and dashboards** for monitoring vulnerabilities.
   * Ideal for **organizations requiring ongoing security testing in development environments**.