Welcome to the next step in your journey to becoming a bug bounty hunter. In our previous lessons, we've explored the rules of the road for web traffic: the structure of HTTP messages and the fundamental security boundary of the Same-Origin Policy. You now understand the theory of how browsers and servers communicate and protect themselves. Today, we get our hands on the single most important tool for a web application tester: the intercepting proxy.
This lesson is all about moving from a passive observer to an active participant in the web traffic conversation. We will introduce you to Burp Suite, the industry-standard tool for web security testing. You will learn how to configure it to sit between your browser and the internet, acting as a "man-in-the-middle." By the end of this lesson, you will be able to launch Burp Suite, intercept live HTTP requests from your browser, inspect their contents, and control their flow to the server. This practical skill is the bedrock upon which almost all web hacking techniques are built.
What is an Intercepting Proxy?
Imagine you could pause time right after you drop a letter in a mailbox, open the envelope, read the contents, change them if you wanted, reseal it, and then let it continue on its way. This is precisely what an intercepting proxy does for your web traffic. It positions itself between your browser (the sender) and the web server (the recipient), giving you complete visibility and control over the communication.
This "man-in-the-middle" position is incredibly powerful. While tools like your browser's developer console can show you requests, a proxy like Burp Suite can stop them, change them, and resend them before the server ever sees the original. For a bug bounty hunter, this is the equivalent of a lab bench for dissecting and experimenting with web applications.
The following video provides an excellent analogy for how Burp Suite works and introduces its core function as a middleman.
How Hackers Use Burp Suite to Get Into Websites
Watch this segment from the video "How Hackers Use Burp Suite to Get Into Websites" by Neurix. It clearly explains the role of an intercepting proxy.
Focus on the explanation of Burp Suite as a "middleman". The video uses a simple search example to show how a request can be intercepted and modified before it ever reaches the server, changing the outcome of the interaction.
Getting Started with Burp Suite
The most popular and powerful intercepting proxy is PortSwigger's Burp Suite. It comes in a free Community Edition, which is more than sufficient for our needs at this stage, and a paid Professional edition with more advanced automation features. For this course, we will assume you have the Community Edition installed.
In the past, setting up a proxy involved manually configuring your browser's network settings. This can be tedious and error-prone. Fortunately, Burp Suite now includes its own pre-configured browser, making the setup process incredibly simple.
The official video from PortSwigger below demonstrates the easiest way to get started.
How to intercept HTTP requests and responses using Burp Suite
This short clip from PortSwigger, the creators of Burp Suite, shows you how to launch Burp's embedded browser.
Watch how to navigate to the Proxy tab and use the "Open Browser" button. This is the key step to getting started quickly, as it bypasses any need for manual configuration.
Once you launch the browser, any website you visit will automatically have its traffic routed through Burp Suite. You don't even need to be actively intercepting to see this traffic. Go to the Proxy tab in Burp Suite, then click the HTTP history sub-tab. You will see a log of every single request your browser has made. This is your first view into the hidden conversation between your browser and the web.
Intercepting and Inspecting Your First Request
While the HTTP history tab provides a great log, the real power comes from active interception. This is done in the Proxy > Intercept sub-tab. Here, you'll find a master toggle button that says "Intercept is on" or "Intercept is off".
When interception is off, Burp acts as a passive observer. Traffic flows through it to the HTTP history without being stopped, and your browser works normally.
When interception is on, Burp acts as a gatekeeper. It will hold onto each request, preventing it from reaching the server until you decide what to do with it.
Let's walk through the process of intercepting a request. The following video demonstrates this with a simple Google search.
How Hackers Use Burp Suite to Get Into Websites
Watch this segment from the Neurix video to see a live interception in action.
First, observe how to turn on interception. Notice how the browser "hangs" or appears to be loading indefinitely. This is a critical indicator that Burp has paused a request. Next, see how the captured request appears in the Intercept tab. You can inspect the full request in various formats like Raw and Pretty. Finally, watch as the request is modified and forwarded. The Forward button sends the request on to the server. The server then responds to the modified request, not the original one.
When a request is caught in the Intercept tab, you have a few primary options:
- Forward: Sends the request (and any modifications you've made) to the server.
- Drop: Discards the request entirely. The browser will eventually time out, as if the server never responded.
- "Intercept is on/off" toggle: This is your master switch. If your browser seems stuck, it's almost always because you've left interception on and Burp is waiting for your input. Toggling it off will let all pending and future traffic flow freely.
The official PortSwigger video also has a great explanation of these controls, including the common pitfall of leaving interception on.
How to intercept HTTP requests and responses using Burp Suite
Revisit the PortSwigger video for a concise technical breakdown of the interception controls.
Watch the explanation of how to forward or drop a single request. Pay close attention to the demonstration of the master intercept toggle and the warning about the browser appearing to spin indefinitely. This is a vital tip for any new Burp user.
Intercepting Server Responses
By default, Burp only intercepts outgoing requests from the browser. In most testing scenarios, this is what you're interested in manipulating. However, there are times when you might want to intercept the response from the server before it reaches your browser. For example, you might want to change a false to a true in a JSON response to see if you can trick the client-side code.
This is not enabled by default, but it's a simple option to turn on.
How to intercept HTTP requests and responses using Burp Suite
This final clip from the PortSwigger video shows you where to find the options for intercepting both requests and responses.
Focus on the section that shows the Proxy Options tab. You can see the checkboxes and rules for intercepting client requests and, importantly, for enabling the interception of server responses. You don't need to memorize these rules now, just know that this is where you can go for more granular control.
Conclusion
In this lesson, you've taken your first and most crucial step into the world of practical web security testing. You've learned how to set up and use Burp Suite, the essential tool for any bug bounty hunter, to get between the browser and the server and see the raw HTTP traffic that underpins the web.
Key Takeaways:
- An intercepting proxy like Burp Suite acts as a "man-in-the-middle," allowing you to view and modify web traffic in real-time.
- The easiest way to start is by using Burp's built-in browser, which requires no manual configuration.
- The
Proxy > Intercepttab is where you can actively pause requests using the "Intercept is on/off" toggle. - Once a request is intercepted, you can
Forwardit to the server orDropit completely. - The
Proxy > HTTP historytab provides a complete log of all traffic that has passed through Burp.
You are now equipped with the "magnifying glass" of the web hacker. You can see the requests, you can pause them, and you can inspect them. But the real power lies in changing them. In our next lesson, we will build directly on this foundation. We'll move beyond simple interception and learn how to methodically modify and replay HTTP requests using Burp Repeater to probe for vulnerabilities and test the limits of a server's logic.