Setting Up Burp and the Proxy

Almost every web finding you make will pass through Burp first. It sits between your browser and the target, catches each request mid-flight, and hands you the raw thing: method, headers, cookies, body, all of it, before the server ever sees it. Get this wiring right once and the rest of the module is just moves layered on top.

Kali ships Burp Community. Start it:

$burpsuite &

Community is free and covers Proxy, Repeater, Intruder (throttled), Decoder, and Comparer. Pro adds the automated scanner and an unthrottled Intruder. Everything in this module works on Community unless I flag otherwise.

The proxy listener

Burp's proxy listens on 127.0.0.1:8080 out of the box. Confirm it under Proxy > Proxy settings, where you'll see one listener bound to that address.

That port is where your browser sends traffic. Leave it at 8080 unless something else already owns the port.

The easy path: Burp's own browser

The fastest start is the browser Burp bundles. Open Proxy > Intercept and click Open Browser. This is a Chromium instance already pointed at the proxy and already trusting Burp's CA, so HTTPS just works with zero certificate setup. For learning and for most engagements, use it.

The other path: your own browser plus the cert

Sometimes you need your real browser for a saved session, an extension, or a specific profile. Point it at 127.0.0.1:8080. In Firefox that lives under Settings > Network Settings > Manual proxy, or cleaner, a FoxyProxy entry so you can flip it on and off without digging through menus.

Then handle HTTPS. Burp decrypts TLS with its own certificate, so without that cert installed every secure site throws a warning. With the browser proxied, visit http://burp, download CA Certificate (it saves as cacert.der), and import it into the browser's trusted authorities. In Firefox: Settings > Privacy & Security > Certificates > View Certificates > Import, then check "trust this CA to identify websites."

Intercept, read, forward

Go to Proxy > Intercept and make sure it reads "Intercept is on". Load a page. The request freezes in Burp instead of leaving. You're now staring at the real HTTP request: the method, the path, the Host header, the cookies, all the fields the UI hid from you. Click Forward to send it on, or Drop to kill it.

That gets old fast, because interception halts every request including images and analytics beacons. For normal browsing, set "Intercept is off" and let everything flow into Proxy > HTTP history instead. That table is a searchable log of every request the browser made through Burp, and it's where you'll spend most of your time. Flip interception back on only when you want to catch and edit one specific request as it happens.