In a nutshell Burp Suite sits between your browser and a website as a proxy, so you can pause, read, and change every request before it reaches the server. Web attacks are the manipulation of HTTP messages — Burp is the workbench where you do that manipulation by hand.
Why you need a proxy at all
The browser hides HTTP from you: you click, a page appears. But almost every web vulnerability lives in the request — a parameter, a header, a cookie. Burp is a man-in-the-middle you run on yourself:
Analogy — an editor's desk between writer and printer. Every letter stops on your desk first; you read it, cross out a line, add a paragraph, then send it on — and the printer never knows it changed.
The core tools inside
| Tool | What it's for |
|---|---|
| Proxy | intercept requests to view/edit before they go |
| Repeater | the workhorse — resend one request again and again with small changes |
| Intruder | automate a request many times with a payload list (brute-force, fuzz, enumerate IDs) |
| Decoder / Comparer | encode/decode (URL, Base64), diff two responses |
A typical flow
1. point browser through Burp, browse the app
2. find an interesting request (login, search, ?id=)
3. send it to Repeater
4. tamper: add ' (SQLi), change id=123→124 (access control),
edit a cookie, swap the method
5. read the response → iterate → that's your finding
Why it's the web tester's home base
Everything ties back to How HTTP works: methods, headers, status codes, cookies. In Burp that knowledge becomes action — you're not "using an app," you're speaking HTTP directly at the server. Nearly every OWASP Top 10 category is tested here: injection payloads in Repeater, access control by editing IDs, auth by replaying session tokens. The free Community edition covers all of this (Intruder is throttled).