Core Tool

Proxy

The Proxy tool is Burp Suite's core component. It sits between your browser and the target web application, intercepting, logging, and allowing you to modify every HTTP/HTTPS request and response. Every security test in Burp begins with Proxy.

By default, Burp listens on 127.0.0.1:8080. Configure your browser to use this proxy, and all web traffic flows through Burp where you can inspect, modify, forward, or drop each request.

How Proxy Works

Burp acts as a "man-in-the-middle" proxy:

1

Browser

Your browser sends HTTP request to proxy (127.0.0.1:8080)

2

Burp Proxy

Burp receives request, displays in Intercept tab (if enabled)

3

Modify?

You modify request/response or forward as-is to target server

4

Response

Server response returns via Burp to browser (also interceptable)

Intercept Tab Functions

The Intercept tab shows each request waiting for your action. From here you can examine and modify before forwarding:

Intercept

Pause and inspect/modify requests before they reach the server. Turn on/off with Ctrl+T.

Forward

Send intercepted request to server. You can modify headers, params, body before forwarding.

Drop

Discard intercepted request. Server never sees it. Useful for filtering noise.

Intercept History

All requests that passed through intercept are logged for later review.

HTTP History

Complete log of all HTTP/S traffic through Burp, even when intercept is off.

WebSocket History

Captures WebSocket messages for real-time application testing.

Match & Replace

Automatically modify requests/responses based on regex rules. Great for bypassing client-side checks.

Options Tab

Configure intercept behavior, SSL pass-through, connection timeouts, and interception rules.

Intercept Controls

Forward (Ctrl+F) — Send request to server
Drop (Ctrl+D) — Discard request, do not forward
Intercept is on/off (Ctrl+T) — Toggle interception globally
Action — Drop-down menu: send to other tools (Repeater, Intruder, etc.)

HTTP History Tab

The HTTP history tab shows all HTTP/S requests that passed through Burp (whether intercepted or not). This is your primary log for reconnaissance and finding interesting endpoints.

Filter by MIME type (HTML, JSON, XML, etc.)
Filter by status code (200, 301, 500, etc.)
Search by keyword, parameter name, or header
Right-click any request to send to Repeater, Intruder, Scanner, or Comparer
Export selected requests to a Burp state file or raw HTTP file
Highlight interesting requests with color markers for later review

Interception Rules

Instead of intercepting every request (overwhelming), configure rules to intercept only specific traffic:

Rule 1:

Intercept client requests

Catch requests from browser before they leave your machine.

Rule 2:

Intercept server responses

Catch responses coming back from server before browser receives them.

Rule 3:

Intercept WebSocket messages

Catch and modify WebSocket frames in real-time applications.

Rule 4:

Intercept based on scope

Only intercept requests within your defined target scope.

Rule 5:

Intercept based on MIME type

Filter by content type (HTML, JSON, XML, etc.).

Rule 6:

Intercept based on file extension

Catch requests for specific file types (.php, .js, .xml).

Info

Configure interception rules in Proxy > Intercept > Intercept is based on rules. Use URL patterns, parameter names, or MIME types to filter.

Scope Configuration

Define your target scope to focus Burp on specific hosts/paths and avoid capturing unrelated traffic:

Target > Scope
• Add target URLs: https://target.com/*
• Include/exclude specific paths
• Enable "Use advanced scope control" for fine-grained rules
• Scope-aware tools respect these boundaries

Tip

Always set your scope before testing. It keeps your project organized, speeds up scanning, and prevents accidental testing of systems you do not have permission to test.
Next: Repeater Back