Burp Suite pulls roughly 14,800 searches a month on Google, and most of that traffic is people trying to get the proxy running, not people comparing brands. The tool sits at the center of nearly every OSCP lab, bug bounty workflow, and professional web app pentest report written in 2026, yet the setup still trips up newcomers: a missing CA certificate, a proxy pointed at the wrong port, or a scanner license that silently caps you at manual testing only. This tutorial walks through installing Burp Suite, wiring up the proxy and browser trust chain, running your first intercepted request, scanning a target, and building a working test project against a legal, disposable app — in 13 steps, about 90 minutes start to finish.
Disclosure and legal note: only run Burp Suite’s proxy, scanner, or Intruder against applications you own, applications you have written permission to test, or purpose-built training targets such as OWASP Juice Shop and DVWA. Scanning or intercepting traffic on systems you don’t control is illegal in most jurisdictions, full stop.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Is Burp Suite and Why It’s the Web App Pentesting Standard
Burp Suite is an intercepting proxy and testing toolkit built by PortSwigger, the same company behind the free Web Security Academy training platform. At its core, Burp sits between your browser and the target web app, letting you view, pause, and edit every HTTP and HTTPS request before it leaves your machine. That single capability — full visibility and control over traffic — is why it became the default tool in professional penetration testing rather than a curiosity.
The toolkit bundles several modules under one interface: Proxy for intercepting traffic, Repeater for replaying and tweaking individual requests, Intruder for automated fuzzing, Scanner for crawling and flagging vulnerabilities, and Decoder/Comparer for encoding and diffing data. Reviews and pentest firm methodology docs published through 2026 continue to call it the de facto standard for professional web application testing and bug bounty work, and it shows up in nearly every modern OSCP prep course and hands-on lab guide as the primary proxy tool.
What makes Burp different from just poking around in a browser’s developer tools is persistence and control. DevTools shows you a request after it’s already gone out; Burp lets you pause it mid-flight, rewrite headers, cookies, or body parameters, and resend it as many times as you want without triggering a fresh page load or re-authenticating. That difference sounds small until you’re testing a login form or an API endpoint that only misbehaves on the fourth or fifth crafted request — something you’d never catch by refreshing a browser tab.
The current release line is Burp Suite 2026.x. The 2026.1.3 update added a new Discover tab that centralizes navigation for people who are still learning where features live, sharper SQL injection detection heuristics in the scanner, SPNEGO support for NTLM authentication (useful when testing apps sitting behind Windows-integrated auth), and an upgrade of the built-in browser’s engine to Chromium 145.x across Windows, macOS, and Linux. The Enterprise/DAST line has followed the same steady cadence of runtime patches: release 2025.1.1 in February 2025 bumped the bundled Java to 21.0.6, and 2025.3 in April 2025 moved the Azul Zulu build up to 21.40.17, both per PortSwigger’s own release notes. A later 2026.4.x point release patched a high-impact bug in the browser’s crawling engine, which is a good reminder to always grab the newest build from PortSwigger’s official release page rather than an older cached installer.
Burp Suite Community vs Professional vs Enterprise/DAST: 2026 Pricing
Before you install anything, decide which edition fits what you’re doing. The three tiers differ by a lot more than price — Community is missing the one feature (Scanner) that most people associate with Burp in the first place.
| Edition | Price (2026) | Automated scanner | Intruder speed | Burp AI | Best for |
|---|---|---|---|---|---|
| Community | Free | Not included | Rate-throttled | Not included | Learning the proxy, manual testing, coursework |
| Professional | ~$499/user/year (up from $449 as of Jan 6, 2026) | Full active + passive scanner | Full speed | Included (2025.2+) | Freelance and in-house pentesters, bug bounty hunters |
| Enterprise/DAST | Quote-only, roughly $6,040 entry – $49,999+/year for unlimited scans (May 2026 data) | Full scanner, multi-agent, scheduled | Full speed | Included | Security teams running continuous scans across many apps and CI/CD pipelines |
Community Edition gives you the intercepting proxy, Repeater, Decoder, and Comparer for free, but Intruder is deliberately slowed down and there’s no automated crawler or scanner at all — you’re testing everything by hand. That’s a fine trade-off if you’re learning, but it means every tutorial you find that shows “run a scan and get a report in five minutes” assumes Professional.
Professional is priced at roughly $499 per user per year as of 2026, following a global price increase from $449 that took effect on January 6, 2026, a jump tracked by both Penetrify and EthicalHacking.ai. PortSwigger’s own buy page still listed that $499/user/year rate as of July 2026, according to CodeAnt.ai, though third-party aggregator G2 recorded Burp Suite editions starting as low as $475 in its February 2026 pricing data. That single license unlocks the full scanner, unthrottled Intruder, project file saving, and Burp AI — a set of assistive features rolled out starting in the 2025.2 release that includes payload suggestions inside Repeater, an “Explore Issue” mode that automatically chases down scanner findings with follow-up requests, and an “Explainer” that writes a plain-English summary of a selected request or finding.
Enterprise, renamed Burp Suite DAST with the 2025.5 release in May 2025, is PortSwigger’s team-scale product: centralized dashboards, scheduled and CI/CD-triggered scans, multiple Docker-deployed scanning agents, and role-based access. The following month’s DAST 2025.6 release, in June 2025, extended the platform’s feature set and its tagging system for organizing scans across large portfolios. Pricing still isn’t published as a fixed list; you request a quote, and community pricing data compiled by BreachVex as of May 2026 puts the entry tier at roughly $6,040/year, scaling up to around $49,999/year for an enterprise tier with unlimited scans. This tutorial focuses on Professional and Community, since that’s what an individual engineer or student will actually install.
Prerequisites and System Requirements
You don’t need much to get running, but a few things will save you a frustrating afternoon later.
- Operating system: Windows, macOS, or Linux, all 64-bit. Modern Burp installers bundle their own tested Java runtime, so you don’t need to manage a separate JRE install.
- RAM: 8 GB minimum; 16 GB recommended if you’ll run the scanner against large single-page apps or keep several project files open.
- CPU: a 4-core (or better) processor keeps scans and Intruder attacks from crawling.
- Disk space: a few GB free for the installer, plus room for project files — large engagements with full HTTP history logging can run into the tens of GB.
- A browser: Burp ships its own Chromium-based browser (now on Chromium 145.x) pre-trusted to its proxy, which is the easiest path for beginners. You can also use Firefox or Chrome with manual proxy and certificate configuration, covered in Step 5.
- A legal test target: OWASP Juice Shop or DVWA (Damn Vulnerable Web Application), both free and designed to be attacked. Docker is the fastest way to stand one up (Step 3 covers this).
- An account with PortSwigger if you’re installing Professional — Community needs no account, just the download.
If you’re on a corporate laptop, check with your security team first: many enterprise networks run SSL-inspecting proxies that will conflict with Burp’s own certificate handling, which we’ll deal with directly in the troubleshooting section below.
It’s also worth deciding upfront whether you’re installing this for a one-off learning exercise or for ongoing paid work. If it’s the latter, budget for Professional from day one rather than building a workflow around Community’s limitations and then having to relearn scanner-driven habits later. The $499/year cost is trivial next to a single billable engagement, and most freelance pentesters treat it as a fixed cost of doing business rather than an optional upgrade.
Steps 1–3: Download, Install, and Launch Burp Suite
Step 1: Download the correct installer
Go to PortSwigger’s official releases page and grab the newest 2026.x build for your OS. Community Edition downloads with no account required; Professional needs you to sign in with your license first. Skip any third-party mirror — there’s no upside to it, and you lose the guarantee that the binary hasn’t been tampered with.
Step 2: Install
On Windows and macOS, run the graphical installer and accept the defaults. On Linux, the installer is a self-extracting `.sh` file:
chmod +x burpsuite_pro_linux_v2026_1_3.sh
./burpsuite_pro_linux_v2026_1_3.shFollow the prompts to pick an install directory (`/opt/BurpSuitePro` is the common default). The installer writes a desktop launcher and a plain jar file you can also run directly from a terminal, which matters once you get to headless scanning in the advanced tips section.
Step 3: Launch and stand up a legal test target
Start Burp. On first launch you’ll be asked to create or open a project — pick “Temporary project” while you’re learning, and switch to a saved project file once you’re doing real engagement work you need to keep. On the next screen, use the “Burp defaults” configuration unless you already know you need something custom.
While Burp opens, spin up a disposable, legal-to-attack target in a second terminal. OWASP Juice Shop is the fastest option via Docker:
docker run --rm -p 3000:3000 bkimminich/juice-shopThat gets you a deliberately vulnerable shopping app at `http://localhost:3000` to practice every technique in this guide against, without any legal gray area.
Steps 4–6: Configure the Proxy Listener and Trust the CA Certificate
Step 4: Confirm the proxy listener
Open the Proxy tab, then Proxy settings. By default Burp listens on `127.0.0.1:8080`. Leave it there unless something else on your machine is already bound to that port — if it is, add a second listener on `127.0.0.1:8081` instead of fighting the conflict.
Step 5: Choose your browser path
You have two options here, and picking the easy one first will save you time:
- Burp’s built-in browser (recommended for beginners): click “Open browser” from the Proxy tab. It’s a Chromium build that’s already configured to route through Burp’s proxy and already trusts Burp’s CA certificate. Traffic starts flowing with zero extra configuration.
- Your own browser (Firefox or Chrome): more flexible for real engagements where you need saved logins or specific extensions, but it requires manually setting the HTTP and HTTPS proxy to `127.0.0.1:8080` in the browser’s network settings, and manually importing Burp’s CA certificate (Step 6).
Step 6: Install and trust Burp’s CA certificate
If you’re using your own browser, this is the step almost everyone gets stuck on. With your browser’s proxy pointed at Burp, navigate to `http://burp` and download the CA certificate from the link on that page. Then import it:
- Firefox: Settings → Privacy & Security → Certificates → View Certificates → Authorities → Import, and check “Trust this CA to identify websites.”
- Chrome/Windows: import into the Windows certificate store under “Trusted Root Certification Authorities.”
- macOS: drag the cert into Keychain Access, then double-click it and set “Always Trust” under the Trust section.
- Linux (system-wide, for tools that read the system trust store rather than a browser’s own store):
sudo cp cacert.der /usr/local/share/ca-certificates/burp.crt
sudo update-ca-certificatesRestart the browser after importing. If you skip this step, every HTTPS site will throw a “connection is not private” warning, because as far as your browser is concerned, Burp is now performing a man-in-the-middle on every request — which is, deliberately, exactly what it’s doing.
Step 7: Intercept and Inspect Your First HTTP Request
With the proxy and certificate in place, go to Proxy → Intercept and make sure “Intercept is on” is showing. Now visit your Juice Shop instance at `http://localhost:3000` in the browser you configured. The page will hang — that’s expected. Burp has paused the request before it left your machine.
Switch to Burp and you’ll see the raw request sitting in the Intercept panel, something like this:
GET / HTTP/1.1
Host: localhost:3000
User-Agent: Mozilla/5.0 (X11; Linux x86_64)
Accept: text/html,application/xhtml+xml
Connection: close
Cookie: session=6f2a9c1e...Click “Forward” to let it through, or edit any header or parameter directly in that panel before forwarding — that edit-then-forward loop is the entire foundation of manual web app testing. Every request your browser sends now passes through this same checkpoint, and every one lands in Proxy → HTTP history, which you can search and filter later.
Turn intercept off once you’ve seen how it works (“Intercept is off” in the same panel) so you can browse normally while Burp logs traffic passively in the background.
Step 8: Use Repeater to Manipulate and Replay Requests
Repeater is where most manual testing actually happens. From HTTP history, right-click any request — a login POST is a good first target — and choose “Send to Repeater.” That opens a dedicated tab where you can edit the request and fire it repeatedly without re-triggering the whole browser flow each time.
Try a basic SQL injection probe against a login form field in Juice Shop (again, this is a target built specifically to be attacked this way):
POST /rest/user/login HTTP/1.1
Host: localhost:3000
Content-Type: application/json
{"email":"[email protected]' -- ","password":"anything"}Click “Send” and compare the response to a normal login attempt. Repeater’s split view shows request and response side by side, and you can keep a history of every variation you tried in that tab, which is invaluable when you’re documenting a finding later for a report.
Step 9: Run Burp Scanner for Automated Vulnerability Detection
This step needs Professional or Enterprise/DAST — Community doesn’t include the scanner. Right-click your target in the site map (Target → Site map) and choose “Scan.” Burp will ask whether to crawl and audit, or audit only; for a first pass, let it do both.
The 2026.1.3 scanner ships with noticeably sharper SQL injection heuristics than earlier builds, plus AI-assisted false-positive reduction specifically for broken access control findings, which used to be one of the noisiest categories in any scan report. Watch the Dashboard tab for live progress and the running issue count. On a small app like Juice Shop, a full crawl-and-audit typically finishes in a few minutes; on a large single-page app with heavy client-side routing, budget considerably longer and consider scoping the crawl to specific paths first.
Findings land under the Dashboard’s Issues panel, each with a severity rating, a description, the exact request/response that triggered it, and (with Burp AI enabled) an auto-generated explanation you can lean on when writing up the finding for a client or a bug bounty submission. Scanner coverage spans the categories most testers actually chase:
| Vulnerability class | Detection type | Notes for 2026 |
|---|---|---|
| SQL injection | Active | Improved heuristics in 2026.1.3 |
| Cross-site scripting (reflected, stored, DOM) | Active + passive | Core detection since early versions |
| Broken access control / IDOR | Active | AI-assisted false-positive reduction |
| CSRF | Passive | Flags missing token protections |
| Server-side request forgery (SSRF) | Active | Out-of-band detection via Burp Collaborator |
| Insecure deserialization | Passive | Flags risky serialization formats |
| Security misconfiguration | Passive | Headers, verbose errors, TLS config |
These map closely to the OWASP Top 10, which is worth keeping open in a tab while you triage results, since it gives you the standard language to describe severity and impact in a report.
Steps 10–11: Extend Burp With BApp Store Tools and Run Intruder
Step 10: Install extensions from the BApp Store
Open the Extensions tab, then BApp Store, and search for these first — they cover gaps the built-in scanner doesn’t, and they’re the ones that keep showing up in 2026 pentest workflow write-ups:
| Extension | What it does | When to use it |
|---|---|---|
| Logger++ | Enhanced, filterable logging of all HTTP(S) traffic | Large engagements where the default HTTP history gets unwieldy |
| Autorize | Replays requests under a lower-privilege session automatically | Testing broken access control and IDOR at scale |
| JWT Editor | Decode, edit, and re-sign JSON Web Tokens | Any app using JWT-based sessions or auth |
| ActiveScan++ | Adds extra active-scan checks beyond the core scanner | Squeezing more coverage out of a Professional scan |
| Burp Bounty | Custom, shareable scanner rule templates | Bug bounty hunters targeting known frameworks |
Click “Install” next to any of these directly from the BApp Store tab; no separate download or restart needed in current builds.
Step 11: Run Intruder for fuzzing and brute-force testing
Send a request to Intruder the same way you sent one to Repeater. Mark the parameter you want to fuzz (a username field, for example) by highlighting it and clicking “Add §” to wrap it in payload markers, then load a payload list under the Payloads tab. A short example wordlist for testing username enumeration:
admin
administrator
test
demo
support
infoIn Community Edition, Intruder is deliberately throttled to a crawl, which is fine for a five-item list like the one above but unusable for real fuzzing against a large wordlist. That throttle is the single biggest practical reason people upgrade to Professional once they move past learning exercises.
Steps 12–13: Use Burp AI and Export Your Findings Report
Step 12: Try Burp AI for faster triage
If you’re on Professional 2025.2 or newer, Burp AI is available directly inside Repeater and the Dashboard. Right-click a request in Repeater and look for AI-suggested payloads and follow-up tests; on a scanner finding, use “Explore Issue” to have Burp automatically chase the vulnerability with additional requests and summarize what it found, or “Explainer” to get a plain-language writeup of a request/response pair you can drop straight into a report draft. It won’t replace judgment on edge cases, but it noticeably cuts the time spent re-explaining a finding from scratch.
Step 13: Export your findings
From the Dashboard, select the issues you want to include and choose “Report selected issues.” Burp generates an HTML or XML export with severity ratings, affected URLs, request/response evidence, and remediation advice per finding, which you can hand off as-is or paste into your own report template. For engagements you’ll revisit, also save the project file itself (File → Save project as) rather than relying only on the exported report — you’ll want the raw traffic history if a client disputes a finding later.
Complete Working Project: End-to-End Test Against a Vulnerable Demo App
Putting the whole flow together, here’s a full session against OWASP Juice Shop that exercises every tool covered above. Budget about 20 minutes for the first full pass, longer if you stop to read every response carefully, which you should — the point of building this workflow is pattern recognition, not speed. Each step below maps back to a step number earlier in the guide, so if something doesn’t behave as expected, you can jump back to the relevant walkthrough.
- Start the target: `docker run –rm -p 3000:3000 bkimminich/juice-shop`
- Launch Burp, open a temporary project, use the built-in browser.
- Browse to `http://localhost:3000`, let Burp passively log traffic in HTTP history.
- Right-click the site root in Target → Site map, run a full crawl-and-audit scan.
- While the scan runs, send the login POST request to Repeater and manually try the SQL injection payload from Step 8.
- Send the same login request to Intruder, mark the email field, load a small username wordlist, and run the attack to look for response-length differences that reveal valid accounts.
- Once the scan finishes, open the Dashboard, sort issues by severity, and use Burp AI’s “Explore Issue” on the top finding.
- Install the JWT Editor extension and inspect the session token issued after a successful login — Juice Shop’s token handling is a well-documented weak point and a good way to see JWT Editor in action.
- Export a findings report covering everything above.
Running through this once, end to end, on a disposable Docker container is the fastest way to build real muscle memory with Burp before you point it at anything that matters.
Common Pitfalls When Setting Up Burp Suite
Most of the friction people run into isn’t a Burp bug — it’s one of a handful of setup mistakes that repeat across nearly every forum thread and support ticket. Here’s what actually goes wrong, in the order beginners tend to hit it.
- Forgetting the CA certificate entirely. If you’re not using Burp’s built-in browser, every HTTPS site throws a trust warning until you import and trust the cert (Step 6). This is the single most common support question in Burp communities.
- Proxying HTTP but not HTTPS. Some browsers let you set an HTTP proxy without automatically applying it to HTTPS traffic. Double-check both fields in your browser’s network settings.
- Wrong port after changing the listener. If you moved Burp’s listener to 8081 to dodge a conflict, but your browser is still pointed at 8080, nothing will intercept and you’ll get generic connection errors with no obvious cause.
- Assuming Community includes the scanner. A lot of first-time users install Community, follow a scanning tutorial written for Professional, and can’t find the “Scan” button because it isn’t there.
- Running Intruder attacks expecting Professional speed on Community. The throttle is intentional and by design; it’s not a bug, and there’s no config flag to remove it.
- Scanning without written authorization. Even accidentally leaving the browser proxied to Burp while browsing a real site can generate traffic that looks like reconnaissance. Turn Intercept and passive logging off, or close Burp, when you’re not actively testing an authorized target.
- Ignoring corporate SSL inspection. On managed laptops, a company proxy may already be re-signing HTTPS traffic, which conflicts with Burp doing the same thing. You typically need to chain Burp through the corporate proxy rather than around it (see troubleshooting below).
Troubleshooting Burp Suite Issues
When something breaks mid-session, it’s almost always traceable to one of eight recurring causes. Check these before assuming Burp itself is broken — in practice, a fresh install rarely is.
| Symptom | Likely cause | Fix |
|---|---|---|
| “Your connection is not private” on every HTTPS site | Burp’s CA certificate isn’t trusted by the browser | Re-import the cert from `http://burp` and restart the browser |
| Nothing shows up in Proxy → Intercept | Browser proxy settings don’t match Burp’s listener port | Confirm Proxy → Options shows the same port as your browser’s HTTP/HTTPS proxy fields |
| Burp won’t launch, silent crash | Conflicting or manually installed Java runtime | Use the official installer’s bundled JRE; don’t override it unless you have a specific reason |
| Scanner never finds the “Scan” option | Running Community Edition | Upgrade to Professional, or test manually with Repeater/Intruder |
| Pages fail to load behind a corporate network | Corporate SSL-inspection proxy conflicting with Burp | Configure Burp’s own upstream proxy settings (User options → Connections) and import the corporate CA into Burp’s trust store |
| Intruder attack is extremely slow | Running on Community’s throttled Intruder | Expected behavior; upgrade to Professional for full-speed attacks |
| Site map stays empty after browsing | Target site uses HSTS or certificate pinning that rejects Burp’s cert | Use Burp’s built-in browser, which handles most HSTS cases automatically, or disable pinning in a test build of a mobile/native app you control |
| High memory use or sluggish UI on large targets | Default JVM heap size is too small for the project | Launch with a larger heap, e.g. `java -jar burpsuite_pro.jar -Xmx4g` |
Advanced Tips for Power Users
Once the basics are second nature, a few habits separate a fast, reliable workflow from a slow one.
Run Burp headless for CI-style checks or resource-constrained environments by launching the jar directly with a memory flag suited to your machine:
java -Xmx4g -jar burpsuite_pro.jarUse project-level scope rules (Target → Scope) so the scanner and Logger++ only ever touch domains you’ve explicitly authorized, rather than relying on memory during a long engagement. Save custom Intruder payload sets and Repeater collections as project templates so you’re not rebuilding common attack sequences from scratch on every new client. If you’re doing recurring work against the same target architecture, write a small Burp Bounty scan profile once and reuse it, instead of relying purely on default scan checks. And if you’re prepping for OSCP or a similar exam, practice the full Repeater-and-manual-injection workflow on Community first — the exam environment won’t hand you Professional’s scanner, so manual fluency is what actually gets tested.
A few more habits worth building early: keep separate project files per client or per engagement rather than one giant running project, since scope creep between clients is both a confidentiality risk and a good way to accidentally scan the wrong target. Use the Comparer tool more than most beginners do — diffing two responses side by side is often faster at spotting a subtle behavioral difference (an extra field, a changed status code, a timing tell) than reading both responses in full. And set a keyboard shortcut for “Send to Repeater,” since you’ll use it dozens of times an hour once you’re in a real testing rhythm; the default is Ctrl+R on most builds, but it’s worth confirming under User options → Keyboard shortcuts if it doesn’t fire the first time.
Burp Suite vs OWASP ZAP vs Caido: Which Should You Use
Burp isn’t the only intercepting proxy worth knowing, and picking the right one depends on budget and how far into professional testing you are.
| Tool | Cost | Strengths | Trade-offs |
|---|---|---|---|
| Burp Suite | Free (Community) / ~$499/yr (Pro) | Mature scanner, huge BApp ecosystem, Burp AI, industry standard for OSCP and pro work | Full feature set locked behind paid tier |
| OWASP ZAP | Free, open source | No cost ever, strong automation/CI story, active community | Scanner tuning and UI generally seen as less polished than Burp Pro |
| Caido | Free tier + paid plans | Modern UI, fast onboarding, popular with newer bug bounty hunters | Smaller ecosystem and less enterprise adoption than Burp |
OWASP ZAP is the obvious choice if budget is the hard constraint — it’s genuinely free forever, not free-with-an-upsell, and it holds up fine for training and smaller engagements. Caido has picked up a following among bug bounty hunters specifically for its cleaner workspace concept and faster learning curve. But for professional pentest reporting, OSCP-style exam prep, and access to the deepest extension ecosystem, Burp Suite Professional remains the default choice reviewers and firms keep landing on through 2026.
Testing APIs and Mobile Apps with Burp Suite
Web app testing is Burp’s original use case, but a growing share of 2026 pentest work is REST and GraphQL APIs with no browser front end at all, plus native mobile apps that don’t use a system-wide proxy by default. Both are handled the same way once you understand the setup differences.
For a pure API target, you don’t need the built-in browser at all. Point any API client (Postman, Insomnia, or curl with the `-x` flag) at `127.0.0.1:8080` and every call routes through Burp exactly like browser traffic does, showing up in HTTP history and available to send to Repeater or Intruder. If you’re working on the Enterprise/DAST side, PortSwigger added native Postman Collection import in the 2025.2 release back in March 2025, so an existing Postman test suite can be fed straight into a scan instead of replaying each request through the proxy by hand. A quick curl example for testing a JSON endpoint through the proxy:
curl -x http://127.0.0.1:8080 -k -H "Content-Type: application/json" \
-d '{"query":"{ user(id: 1) { email } }"}' \
http://localhost:3000/graphqlThe `-k` flag skips certificate verification on the client side, which is fine for a quick test but not something you’d want in a script you keep around, since it silently defeats the point of TLS validation. For repeated API testing, import Burp’s CA cert into your API client’s trust store instead, the same way you did for a browser in Step 6.
Mobile apps need one extra step: an Android emulator or a rooted/jailbroken device set to use your machine’s IP and Burp’s port as its Wi-Fi proxy, plus the CA certificate installed as a user (or system, on newer Android versions with app-level pinning) certificate. Apps that implement certificate pinning will still reject Burp’s cert even after it’s trusted at the OS level; testing those requires a pinning-bypass tool such as Frida on a build you’re authorized to modify, which is beyond the scope of this setup guide but worth knowing about before you assume an app “can’t be intercepted.”
One more feature worth knowing for both API and mobile work: Burp Collaborator, PortSwigger’s out-of-band interaction service, which the scanner uses automatically to catch blind SSRF and blind injection bugs that never produce a visible response. If you’re testing on an isolated network with no outbound internet access, you can also self-host a private Collaborator server, which is a common requirement in banking and government engagements where sending any traffic to PortSwigger’s public infrastructure isn’t allowed.
Frequently Asked Questions
Is Burp Suite Community Edition good enough to learn penetration testing?
Yes, for manual testing. You get the proxy, Repeater, Decoder, and Comparer for free, which covers most of what an OSCP-style exam actually tests. You’ll only feel the limits when you need the automated scanner or full-speed Intruder for large-scale fuzzing.
What port does Burp Suite use by default?
The proxy listener defaults to `127.0.0.1:8080`. You can add additional listeners on other ports under Proxy → Options if that one’s already in use.
Why do I get certificate warnings on every website after installing Burp?
Your browser hasn’t trusted Burp’s CA certificate yet. Either switch to Burp’s built-in browser (already trusted, zero setup) or manually import the certificate from `http://burp` while proxied, as covered in Step 6.
Is it legal to use Burp Suite?
The software itself is legal to own and run everywhere it’s sold. What’s illegal, in most jurisdictions, is using it to intercept, scan, or attack systems you don’t own and don’t have explicit written permission to test. Stick to your own apps, authorized client engagements, or purpose-built targets like OWASP Juice Shop and DVWA.
How much does Burp Suite Professional cost in 2026?
Roughly $499 per user per year, following a price increase from $449 that took effect on January 6, 2026. Community Edition remains free, and Enterprise/DAST pricing is quote-only.
Does Burp Suite work on Mac, Windows, and Linux?
Yes, all three, and current builds bundle their own tested Java runtime so you generally don’t need to install or manage Java separately.
What is Burp AI and do I need it?
Burp AI is a set of assistive features in Professional 2025.2 and later: payload suggestions in Repeater, automatic follow-up testing on scanner findings (“Explore Issue”), and plain-language write-ups of requests (“Explainer”). It’s not required to use Burp effectively, but it noticeably speeds up triage and reporting once you’re working through a large issue list.
Should I use Burp Suite or OWASP ZAP as a beginner?
Either is a reasonable starting point. Burp Community teaches you the same manual workflow used in professional testing, and most paid courses and certification labs are written around Burp’s interface. ZAP is a solid free-forever alternative if you’d rather not think about a future upgrade at all.
Can Burp Suite test REST APIs and GraphQL, not just websites?
Yes. Point any API client or curl command at Burp’s proxy address the same way you’d point a browser, and every request shows up in HTTP history ready to send to Repeater, Intruder, or the scanner. No browser is required for pure API targets.
Why isn’t Burp intercepting traffic from my mobile app?
Either the device’s Wi-Fi proxy isn’t pointed at your machine’s IP and Burp’s port, the CA certificate isn’t installed on the device, or the app uses certificate pinning, which rejects Burp’s certificate even when it’s otherwise trusted. Pinned apps need a separate bypass tool such as Frida before Burp can see their traffic.
Related Coverage
- Set Up Zero Trust Network Access: 15 Steps, 100 Min [2026]
- CrowdStrike vs SentinelOne vs Defender: 100% MITRE [2026]
- EDR vs XDR vs MDR: 17x Per-Endpoint Cost Gap [2026]
- How to Set Up Passkeys: 13 Steps, 90 Min [2026]
- Verizon DBIR: Exploits Overtake Credentials at 31% [2026]
- How to Set Up a YubiKey: 13 Steps, 60 Min [2026]
- How to Set Up Vaultwarden: 12 Steps, 80 Min [2026]
