burp suite for web app testing, the practical version

your app is talking, are you listening

every web app you own is constantly sending data back and forth between the browser and the server, and most of that traffic is invisible unless you go looking for it. burp suite is the tool for going looking. it's built for testing web apps, and if you're the one running the app, that means using it to find your own weak spots before someone else does. this is the practical rundown of how it works, so you can point it at your own staging environment and actually learn something useful.

proxy: see every request your app makes

burp sits between your browser and the internet as a proxy. once you point your browser at it, every single request your app sends, every cookie, every hidden parameter, every api call, shows up in plain view. this matters because devs often assume "the user can't see this" when really the user's browser is sending it right out in the open. if you've never proxied your own app through burp, you'd be surprised how much gets exposed in request bodies and headers that you thought were server-side only.

set it up on a test or staging instance, never production traffic with real user data unless you know exactly what you're capturing and where it's stored.

repeater: manually poke at logic, not just syntax

repeater lets you take a single captured request, tweak it by hand, and resend it as many times as you want. this is where you catch logic flaws that automated scanners miss entirely, the classic example being idor, insecure direct object reference. that's when your app checks "does this id exist" but forgets to check "does this id belong to this user." you change a user id or order number in the request and suddenly you're looking at someone else's data.

as a defender, this is the single best use of your testing time. walk through your own app's core workflows, account settings, invoices, messages, anything with an id in the url or body, and manually swap those values while logged in as a different low-privilege test account. if you get back data that isn't yours, you've found a real bug, not a theoretical one.

intruder: fuzz parameters before an attacker does

intruder automates sending a request over and over with different payloads swapped into a chosen parameter. you're testing things like sql injection strings, command injection attempts, or path traversal patterns against your own input fields. the goal is to see if your app chokes, errors out with a stack trace, or behaves differently in a way that reveals it's not sanitizing input properly.

run this against a copy of your app, not live production, since aggressive fuzzing can generate a wall of junk data or trip up rate limits and logging. watch for error messages that leak database details, unexpected 500s, or responses that took way longer than normal, that timing difference is often a sign of a blind injection point.

scanner: catch the low hanging fruit fast

burp's scanner automatically checks for the obvious stuff, reflected and stored xss, missing security headers like content-security-policy or x-frame-options, insecure cookie flags, that kind of thing. it won't find your business logic flaws, that's what repeater is for, but it's a fast first pass to catch misconfigurations that are genuinely easy to fix and easy to miss.

run it, get the report, and actually triage it. a lot of scanner output is noise or low severity, but missing headers and unescaped output in your html are cheap wins that close real doors.

fixing what you find

the point of all this isn't the tool, it's what you do after. for idor, enforce authorization checks server side on every object access, never trust that a hidden field or a sequential id is protection. for injection, use parameterized queries and proper input validation, not blocklists. for xss, escape output based on context and set a real content-security-policy. for headers, there's no excuse, add them at the reverse proxy or framework level and move on.

the takeaway

your app can't hide what it sends over the wire, and that's actually good news if you're the one testing it. burp suite gives you the same view an attacker would have, proxy to see the traffic, repeater to test logic by hand, intruder to fuzz for injection, scanner to catch the easy misses. run it against your own staging environment regularly, fix what it turns up, and you've closed the gap before anyone else finds it first.