Burp Suite is an intercepting proxy that sits between your browser and your web application, letting you inspect, modify, and replay every HTTP request before it reaches the server. For Indian dev and security teams testing their own applications, a practical workflow runs proxy intercept, then Repeater for manual probing, then Intruder for controlled fuzzing (authorised targets only), then Scanner for automated coverage, and finally a written report mapped to OWASP categories. This article walks through each stage, plus where Burp fits inside a full VAPT (Vulnerability Assessment and Penetration Testing) engagement.
Before anything else: only run these techniques against applications you own, or have explicit written authorisation to test. Scanning a third-party asset without permission is a criminal offence under India's IT Act, Section 43/66.
Why Burp Suite Is the Default Web App Testing Tool
Most manual web application testing — by an in-house developer, a freelance pentester, or a formal VAPT team — happens through an intercepting proxy. Burp Suite has become the default choice because it combines a proxy, a request repeater, a fuzzer, a passive/active scanner, and a scriptable extension framework in one interface. Unlike a pure automated scanner, Burp lets a human tester understand application logic and craft attacks mapped to the OWASP Top 10 that a scanner alone would miss.
For teams building fintech, healthtech, or e-commerce products under India's DPDP Act 2023 obligations, this manual-plus-automated approach is not optional polish — it is closer to what regulators and enterprise customers expect before a product goes live.
Setting Up the Intercepting Proxy
The foundation of every Burp session is the proxy. Burp listens on a local port (127.0.0.1:8080 by default), and your browser is configured to route traffic through it.
Core setup steps:
- Install Burp's CA certificate in a dedicated testing browser profile — this lets Burp intercept HTTPS traffic without constant certificate warnings.
- Configure the browser proxy (or use FoxyProxy) to point at Burp's listener address.
- In Burp's Proxy tab, turn "Intercept" on to pause every request for review, or rely on the Proxy history log to review traffic passively.
- Scope the target: add your application's domain(s) to Target > Scope, and enable "Show only in-scope items" so history and Scanner stay focused on your asset.
Once intercept is live, every request passes through Burp before hitting the server. This is where a tester first spots session tokens sent in the URL, missing Secure/HttpOnly cookie flags, or verbose error responses.
Repeater: Manual, Repeatable Request Testing
Once you capture an interesting request in Proxy history, send it to Repeater (right-click > "Send to Repeater," or Ctrl+R). Repeater lets you edit a single request and resend it repeatedly, comparing responses side by side without re-triggering the full flow each time.
Typical Repeater use cases:
- Parameter tampering — changing a
user_idororder_idvalue to test for Insecure Direct Object Reference (IDOR), where one user can access another user's data by altering an identifier. - Authentication and session testing — replaying a request with an expired or another user's session token to check server-side enforcement.
- Business logic checks — resubmitting a request with a negative quantity, a discount code applied twice, or a state-skipping step in checkout.
- Input validation probing — sending crafted payloads into individual parameters and reading the raw response for stack traces or unexpected behaviour.
Know your vulnerabilities before attackers do
Run a free VAPT scan — takes 5 minutes, no signup required.
Book Your Free ScanIntruder: Controlled Fuzzing — Authorised Use Only
Intruder automates sending many variations of a request — substituting payloads into marked positions and capturing every response for comparison. It is powerful for brute-forcing weak credentials, enumerating usernames, or fuzzing input fields at scale.
Intruder's four attack types cover most fuzzing needs:
| Attack type | What it does | Common use |
|---|---|---|
| Sniper | One payload set, cycled through each marked position individually | Fuzzing a single parameter for injection points |
| Battering ram | Same payload inserted into all positions simultaneously | Testing where multiple fields must match (e.g., password + confirm) |
| Pitchfork | Multiple payload sets, one per position, iterated in parallel | Testing paired username/password combinations from a specific list |
| Cluster bomb | Multiple payload sets, all combinations tried | Full credential brute-force across username x password lists |
Scanner: Automated Crawl and Active Scan
Burp's Scanner (Pro edition) combines a crawler that maps the application's structure with an active scanner that injects test payloads across all discovered inputs, flagging issues like reflected/stored XSS, SQL injection, SSRF, and insecure deserialization mapped to the OWASP Top 10 and to secure-coding controls in NIST's Special Publications series.
Scanner is not a replacement for manual testing — it is a coverage tool. It catches the "wide but shallow" issues fast, freeing the human tester's time for business-logic flaws and chained exploits that automated tools cannot reason about. A realistic workflow runs Scanner early for a baseline, then spends the bulk of manual effort on what Scanner cannot see.
These figures, from Verizon's 2024 Data Breach Investigations Report, show why automated Scanner coverage against known exploitable flaws matters as much as credential hygiene.
Sequencer: Testing Session Token Randomness
Sequencer analyses the randomness (entropy) of tokens your application generates — session IDs, password reset tokens, CSRF tokens. Feed it a sample of live tokens captured via Proxy or Intruder, and it runs statistical tests to estimate whether generation is sufficiently unpredictable.
This matters because a token that looks random but is generated from a predictable seed — a timestamp, a sequential counter, a weak PRNG — can let an attacker guess or brute-force valid sessions. Sequencer is a quick, high-value check often skipped simply because testers assume "it looks random enough."
Decoder: Encoding and Hashing Utility
Decoder is Burp's utility for encoding, decoding, and hashing data — Base64, URL encoding, HTML entities, hex, and common hash functions. It is used constantly and briefly: decoding a JWT to inspect its claims, URL-decoding a parameter to see the raw payload, or generating a hash to compare against a captured value. It has no standalone workflow — it is the utility you reach for mid-way through Repeater or Proxy analysis.
Extensions: Extending Burp via the BApp Store
Burp's functionality extends through the BApp Store, a marketplace of community and vendor-built extensions accessible from the Extensions tab. Common categories include additional passive scan checks, authentication-flow helpers for OAuth/SSO-heavy applications, JSON Web Token analysis tools, and reporting helpers that reformat findings for handoff. Vetted, actively maintained extensions from the official BApp Store are the safer choice over unverified third-party scripts.
Community vs Pro: What Actually Changes
At a high level, the practical difference between Burp's free and paid tiers comes down to three capabilities:
- Automated active scanning — the free tier supports manual testing (Proxy, Repeater, throttled Intruder, Decoder, Sequencer) but lacks the fully automated crawler-plus-active-scanner combination.
- Speed — Intruder and other request-heavy tools are throttled in the free tier, which matters for large applications or time-boxed engagements.
- Extended extension support and CI/CD integration — the paid tier's ecosystem is built out further for pipeline-embedded scanning.
A Realistic End-to-End Testing Workflow
- Scope and authorise — confirm in writing which domains and environments are in scope, and the testing window.
- Recon and crawl — browse manually with Proxy intercept on to build an accurate site map; supplement with Scanner's crawler.
- Baseline automated scan — run Scanner (Pro) or a manual checklist-driven passive review (Community) to catch known-pattern issues fast.
- Manual deep-dive with Repeater — target authentication, authorisation, session management, and checkout flows for logic flaws Scanner cannot detect.
- Targeted fuzzing with Intruder — on staging or with explicit authorisation, test rate limiting and brute-force resistance.
- Token analysis with Sequencer — validate session and CSRF token entropy.
- Triage and reproduce — confirm each finding manually, rate severity, and eliminate false positives.
- Report and retest — deliver findings mapped to OWASP Top 10 categories with remediation guidance, then retest after fixes.
Where This Fits Into a Full VAPT Engagement
Burp Suite is the primary tool in the web application layer of a broader VAPT scope, which also covers network-level testing, API testing, and — for regulated sectors — DPDP Act 2023 data-handling review. In-house teams should run Burp-based checks continuously. But for a point-in-time, audit-grade assessment that banks and enterprise customers request before onboarding a vendor, most Indian organisations pair internal testing with a formal engagement delivered with a CERT-In empanelled partner.
Bachao.AI, built by Dhisattva AI Pvt Ltd, helps Indian teams combine manual and automated web application testing into a continuous, audit-ready VAPT process. If your team wants an outside baseline before your next release, start with a free VAPT scan. For obligations around personal data handling, see our guide on DPDP compliance, and browse more testing write-ups on the Bachao.AI blog.