Can I use Burp Suite on any website?

Only on sites you own or are authorized to test. Intercepting your own traffic is fine, but sending modified or automated requests to someone else's site without permission can be illegal.

Is Burp Suite or ZAP better for beginners?

Both teach the same concepts. ZAP is fully free and open source with an automated scanner, while Burp Community has a polished manual workflow. Learning one makes the other easy.

Web Application Testing with Burp Suite and the OWASP WSTG

Introduction

Understanding how a web application behaves on the wire is a core security skill. An intercepting proxy sits between the browser and the server so you can see and modify every request. Burp Suite is the most widely used one, and its free Community Edition is enough to learn. Use it only against your own practice applications.

Prerequisites

The OWASP Top 10 lesson
A practice target such as OWASP Juice Shop running locally

Step-by-Step Guide

Step 1: Start from the OWASP Web Security Testing Guide

The WSTG is OWASP's free, detailed guide to testing web applications. It is organized into categories such as information gathering, configuration, identity management, authentication, authorization, session management, input validation, error handling, cryptography, business logic, and client-side testing. Use it as a checklist so your testing is systematic rather than random.

Step 2: Set up the proxy

Install Burp Suite Community Edition from PortSwigger's website. Burp runs a proxy listener, by default on 127.0.0.1 port 8080. Burp's built-in browser is preconfigured to use it and trusts Burp's certificate, so it is the easiest way to start, with no browser settings to change. Browse to your local practice target through that browser, with the target running on your own machine.

Step 3: Watch the traffic

With interception on, each request pauses so you can inspect or change it before forwarding. With interception off, requests still appear in the HTTP history. Look at the headers, cookies, parameters, and responses. Ask what the client sends that the server trusts: hidden form fields, prices, identifiers, and role values are all client-controlled data and can be changed by anyone.

Step 4: Replay and modify requests with Repeater

Send an interesting request to Repeater, change one value at a time, and observe the response. This is how you test, in your lab, whether the server enforces authorization, for example by changing an object identifier and checking whether the server returns another user's data. That is a broken access control test, and finding it in a practice app shows exactly why server-side checks matter.

Step 5: Know the Community Edition limits

The Community Edition includes the proxy, Repeater, Decoder, Comparer, and a rate-limited Intruder. The automated vulnerability scanner is part of the paid Professional edition. Free alternatives for automated checks include OWASP ZAP, covered in the previous testing lesson. Manual testing skill matters more than any scanner, because scanners miss logic flaws.

Step 6: Record findings and translate them into fixes

For each issue found in your practice app, write down the request that proves it, why it works, and how the code should be fixed, such as adding an ownership check or encoding output. This habit turns testing into learning and, in real engagements, becomes the report. Juice Shop includes a scoreboard of challenges that map nicely to the OWASP Top 10 categories.

FAQs

Can I use Burp Suite on any website?: Only on sites you own or are authorized to test. Intercepting your own traffic is fine, but sending modified or automated requests to someone else's site without permission can be illegal.
Is Burp Suite or ZAP better for beginners?: Both teach the same concepts. ZAP is fully free and open source with an automated scanner, while Burp Community has a polished manual workflow. Learning one makes the other easy.

Summary

Use the OWASP WSTG as your checklist and an intercepting proxy such as Burp Suite Community to inspect and replay requests against your own practice app, understand what clients can control, and turn each finding into a code fix.