I'm looking for a good resource for learning/configuring BURP. I understand the concepts behind using the framework, and have read the docs on the site, but if anyone has a solid tutorial link I would love to see it. I would've made this a wiki but I'm not looking to compile a large resource, I just want a couple solid links and I will close the question.

Links to preconfigured BURP setups are also appreciated.

To specify a bit further, I'm particularly interested in the ideal setup for manual spidering, as I prefer the stealthiness and the ability to control vs. flooding tons of pages.

  • BURP is simple - just swallow some air and wait for it to come up. ;-) – Iszi Feb 24 '11 at 15:41
  • As a word of caution, if you don't use BURP suite early on to catch security mistakes, you'll probably find yourself using the Forensic Analysis and Response Toolkit to deal with the unpleasant aftermath. [ducks] Come on, you know you were thinking it. – tylerl Oct 8 '12 at 5:47

Along with advice on how to use Burp, you should also not forget to customise the following:

Form Submission:

To set suitable names and values for forms submitted by Burp, as I presume you don't want to send 'Weiner' :-)

Within the Burp window - navigate to the 'Spider' tab and then the 'options' menu. From here you should update the standard values within the forms section:


Click on each value and select 'edit', change the value and then click on the 'update' field before selecting the next value:



You can also edit the default payloads that are used within Burp. This can be done by unpacking the .jar file. This example uses 7Zip to unpack the latest Burp file.

Firstly right click on the .jar file and select open with 7Zip. This will show:


Then open up burp\PayloadStrings\:


From this folder, select fuzzing - full.pay. Within this file you will see options that can be configured to your specific needs (highlighted in the following image):



For manual spidering then Burps own help page has the following advice:

passively spider as you browse - If checked, Burp Spider will process all HTTP requests made through Burp Proxy, to identify links and forms on web pages visited. Using this option can enable Burp Spider to build up a detailed picture of an application's contents even when you have only browsed a subset of that content with your browser, because all content that is linked from visited content is automatically added to the Suite site map.

This is done by visiting the 'Spider' tab and then selecting the 'options' tab:


This way, you control the generation of the site map without flooding the host with traffic.

Hope this helps.

| improve this answer | |
  • I knew about the form submission portion, payload customization in the jar was something I hadn't had a chance to check out yet, very cool. I would accept this, except there wasn't an include for steps to properly capture manual spidering, could you add that? I appreciate you taking the time for screenshots and all, nice post +1 – mrnap Feb 25 '11 at 4:35
  • 2
    I have added some further information around manual spidering with Burp. – David Stubley Feb 25 '11 at 8:57

Absolutely absolutely pick up the Web Application Hackers Handbook by Portswigger (author of Burp), which is written as both an introduction to the concepts relevant to Web App reversing / hacking, but also as a step-by-step guide for applying those concepts with Burp Suite.

Note that the Second Edition is now available.

| improve this answer | |

One good sequence of tutorials I've seen is on the Security Ninja site. That links got the last one in the series (focuses on the scanner tab) but there's links to the other ones from that page.

| improve this answer | |
  • Nice link, I'm in the process of reading it all +1 – mrnap Feb 25 '11 at 4:36

This one from SalesForce seems okay - a wee bit basic if you have used burp before.

| improve this answer | |

In version 1.5 Burp contains solid built-in help that can be used as tutorial. It's accessible via Help -> Burp Suite Help

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.