Why Burp Suite is needed in CTF
Burp Suite is an HTTP proxy from PortSwigger that stands between the browser and the server. Each request and every response goes through it. You can stop the request, change any field - title, cookie, body parameter - send further and see what the server will say. According to Bugcrowd, Burp Suite is the industrial standard: “nearly every professional web pentest and bug bounty work runsflow through it or a tool like it.” More information - in our detailed analysis of the pentest of web applications.
For CTF webcasts, this gives specific things:
The hidden parameters in HTML forms, invisible in the browser, are visible in the raw query
Cookies with base64-coded roles can be decoded and substituted directly in the title
Server responses with commented prompts or flags are visible in full response
One request can be sent dozens of times with different values via Repeater – without reloading the page
Burp Suite Community Edition is free and contains everything you need for CTF: Proxy, Repeater, Decoder and Intruder (with speed limit). The vulnerability scanner is only in Professional, but it is not needed for CTF. Tasks are solved by hands, through understanding the logic of the application.
Installation of Burp Suite Community Edition
The installer swings from the official website portswigger.net/burp/releases#community. Starting with version 2026.4, PortSwigger uses a single installer for Community and Professional – when you start, select the desired version.
Minimum system requirements: Windows 10+, macOS 10.14+ or any modern Linux distribution, 4 GB RAM (8 GB recommended). Java 17+ is built into the installer – you do not need to put anything separately.
First start: Temporary project → Use Burp defaults → Start Burp. For CTF tasks, a temporary project is enough to keep a story between sessions usually not. Immediately switch the topic to dark: Settings → Display → Theme → Dark. The eyes will thank you after a couple of hours of selection of requests.
Setting up a Burp Suite proxy — step-by-step instructions
Burp Suite proxy by default listens to on 127.0.0.1:8080. It remains to send the browser traffic there. Two ways – choose which is more convenient.
Quick track – Burp browser
In the Proxy tab → Intercept, press Open Browser. The built-in Chromium, already configured to work with Burp, will open: no proxy settings, no certificates. PortSwigger describes it as "preconfigured work to Burp right out of the box."
Minus: This is a separate browser without your bookmarks and extensions. For a quick CTF, a CTF is the perfect option. For constant work, it is better to set up Firefox through FoxyProxy.
Set up FoxyProxy in Firefox
FoxyProxy is an extension for switching the proxy with one button. Without it, you will have to get into the Firefox network settings manually each time.
Installation process:
Open Firefox, go to about:addons
Find FoxyProxy Standard, install
Click on the FoxyProxy icon in the toolbar → Options
Click Add and fill in the fields: Title — Burp Suite, Proxy Type — HTTP, Proxy IP — 127.0.0.1, Port — 8080
Save the configuration
Now switching between the regular Internet and working through Burp is one click on the FoxyProxy icon. Select the “Burp Suite” profile – traffic goes through a proxy. Select “Turn Off” – the browser works directly.
Critical point: While FoxyProxy directs traffic to Burp, and Burp itself is not launched – no site will load. It's not a bug. Run Burp or turn off FoxyProxy.
Installing the Burp Suite SSL Certificate
Without this step, each HTTPS site will show a security error. Burp Suite generates its own CA certificate for the signature of intercepted HTTPS traffic, and the browser must trust it.
Launch Burp Suite, enable FoxyProxy on the “Burp Suite” profile
In the browser, go to http://burp ( HTTP, not HTTPS)
Click CA Certificate — file is downloaded cacert.der
In Firefox: Settings → Privacy and Protection → Scroll to the Certificates block → View Certificates
Certification Centers tab → Import → select downloaded file
Check the “Trust when identifying websites” → OK
Check: Go to any HTTPS site (e.g. google.com). The page is loaded without warnings – the certificate works. In Burp in the Proxy → HTTP history tab you will see decrypted HTTPS requests.
The most common mistake of beginners: everything is configured, HTTP sites work, and HTTPS issues SEC_ERROR_UNKNOWN_ISSUER. The reason is the missed step with the certificate. Without a CA certificate, HTTPS traffic interception in Burp Suite is not possible. The point.
HTTP Queries Interception – First Intercept
Including Interception
In Burp, open the Proxy → Intercept tab
Make sure the switch is on Intercept is on
In the browser (via FoxyProxy on Burp) go to any site
The page will “hang” – that’s normal. Burp delayed the request until your decision. In the Intercept tab, you will see a raw HTTP request: GET or POST method, URL, Host headers, User-Agent, and query body.
Three control buttons:
Forward – send a request further to the server
Drop - destroy the request (the server will not receive it, the action will be canceled)
Intercept is on/off – global interception switch
Press Forward several times until the page is fully loaded. The browser sends dozens of queries to one page: HTML document, CSS-styles, JavaScript files, images, metrics of analytics. Each of them goes through Burp. Yes, it’s exhausting – so it’s about HTTP history.
HTTP History – view without interception
For CTF, constant interception is inconvenient: each request has to be passed manually. Switch Intercept to off and just use the site as usual. All requests are recorded in Proxy → HTTP history.
In history you can:
View every request and response raw
Filter by domain, HTTP method, status code
Search for text inside queries and responses
Send interesting requests to Repeater for modification
PortSwigger documentation says that viewing HTTP history after interacting with the site is "is more convenient in many cases." In practice, this is how you work: first, study the application as an ordinary user - click on links, send forms, log in. Then open HTTP history and analyze the recorded traffic. This is the workflow on the CTF.
Repeater is the main weapon for CTF web tasks
Proxy →Intercept catches requests on the fly. Repeater allows you to take any request, change it and send as many times as required. For web CTF tasks, this is the main working tool. I would say 80% of the decisions are born here.
How to send a request to Repeater
In HTTP history, find the desired request (POST on the login form, GET with interesting parameters)
Right click → Send to Repeater (or Ctrl+R)
Go to the Repeater tab
On the left is a request that can be edited. On the right is the server response. Changed the parameter, pressed Send, studied the answer. Changed again – Send. The browser is not involved.
Typical manipulations for CTF
Cookie substitution is a frequent CTF pattern. The server exhibits a cookie of the type user=guest or isAdmin=false. In Repeater find a title Cookie: and change the meaning. If isAdmin=false replace by isAdmin=true and the server will swallow this without server verification - in front of you Broken Access Control (A01:2021 on OWASP Top 10).
Modification of hidden POST parameters – HTML contains <input type="hidden" name="price" value="100">. In the browser the field is invisible. In Burp Suite you see price=100 in the request body and can be replaced by price=0. The server trusts the data from the client without validation - classics.
HTTP method change – some CTF tasks check how the server responds to GET instead of POST or vice versa. In Repeater, the method changes the editing of the first line of the query. One letter is another result.
Substitution User-Agent – the task can check from which “browser” the request came. Replacement of the User-Agent string with the required value (Admin-Console, a specific version or bot string) solves such problems.
Solving the CTF web task: full disassembly
Let's look at the typical CTF scenario. The pattern is based on common Entry-level CTF platform tasks: parameter substitution and data decoding.
Intelligence: studying requests
Open the CTF task in the browser through Burp-proxy. On the page is a login form with username and password fields. Enter admin / password, get "Access laze". The browser’s DevTools show the standard form – nothing suspicious.
Go to Burp → Proxy → HTTP history. Find a POST request to /login. See the body:
POST /login HTTP/1.1
Host: ctf-challenge.example
Content-Type: application/x-www-form-urlencoded
username=admin&password=password&role=user
Parameter role=user - it was not visible on the page. A hidden form field that the browser sends automatically. In DevTools it can be found, but in the HTML stream it is easy to miss. In Burp, it is visible immediately - in a raw request, you can not hide anything.
Operation via Repeater
Send a request to Repeater (Ctrl+R). Change role=user on role=admin. Pressing the Send.
The server’s response changed: instead of “Access denied” came HTML with the text “Welcome, admin!” and the line flag: Q29kZWJ5X0JTX0ZsYWc=. The server did not check the parameter value role on the backend side – dumbly trusted the client data. Classic Broken Access Control.
Flag decoding via Decoder
The line Q29kZWJ5X0JTX0ZsYWc= ends on = – characteristic feature of Base64. Open the Decoder tab in Burp Suite, paste the line, press Decode as → Base64. The result is the readable text of the flag.
Decoder supports URL coding, HTML-entity, hex, and other formats. In CTF there are multi-level encodings - these dolls: Base64 inside the URL-encode, for example. Decoder allows you to apply decoding sequentially: the result of the first decoding is submitted to the input of the second.
The whole process from opening the task to the flag is 5-10 minutes when you know the algorithm. Without Burp Suite, it would take an hour of picking in DevTools, and the hidden parameter in the POST TV is easy to miss.
Intruder for automated overkill
When you need to check the set of values in one parameter, manual Repeater is slow. Burp Suite Intruder automates too much and will be useful for CTF tasks:
Search for user IDOR vulnerability search ID
Selection of short PIN codes or tokens
Phasing parameters with special symbols
Algorithm of work:
Right click on request → Send to Intruder
Positions tab: highlight the value for the overkill, press Clear §, then Add § around the desired option
Payloads tab: add a list of values manually or download from the file
Start attack
Intruder will show the results table with each payload, status code, and response length. Look for anomalies: If 99 queries gave a response 1200 bytes long and one 3400 bytes, this payload deserves attention in Repeater.
In Community Edition, Intruder is limited in speed – approximately one request per second. For CTF, enough: tasks rarely require a selection of thousands of values. A serious brutforce will require a pro version or external tools like ffuf and hydra.
Beginner mistakes when working with Burp Suite
These problems occur at each first launch. I went through everything myself.
The sites do not open – FoxyProxy directs traffic to Burp, while the Intercept is included. Each request is waiting for Forward to be pressed. Solution: Turn off the Intercept if you don’t need a step-by-step intercept. Traffic is still recorded in HTTP history.
HTTPS issues a certificate error – no Burp Suite CA certificate is installed. Without it, the browser does not trust the signature Burp and blocks the connection. Return to the installation section of the SSL certificate.
HTTP history is clogged with garbage – Burp records absolutely everything: Google Analytics metrics, queries to CDN, Firefox extension updates. Solution: in Target → Scope add the CTF domain platform. In HTTP history, enable the filter “Show only in-scope items.” The trash will be less.
The Internet is “missing” after the closure of Burp – FoxyProxy is still driving traffic to a nonexistent proxy. Click on the FoxyProxy icon → Turn Off. Use to check FoxyProxy first thing when “the Internet does not work.”
Repeater returns an error, although everything worked in the browser - there is no mandatory title in the request. Most often it is a cookie with a session ID or incorrect Content-Type. Compare the request in Repeater with the original in HTTP history – find the differences.
Hotkeys to speed up work
On CTF-competitions time is limited. These combinations save minutes:
Ctrl+R – send a request to Repeater
Ctrl+I – send to Intruder
Ctrl+Shift+R – repeat the last request
Ctrl+F – search inside a query or answer (indispensable for search flag{ or ctf{ in the long server responses)
Burp Suite is an HTTP proxy from PortSwigger that stands between the browser and the server. Each request and every response goes through it. You can stop the request, change any field - title, cookie, body parameter - send further and see what the server will say. According to Bugcrowd, Burp Suite is the industrial standard: “nearly every professional web pentest and bug bounty work runsflow through it or a tool like it.” More information - in our detailed analysis of the pentest of web applications.
For CTF webcasts, this gives specific things:
The hidden parameters in HTML forms, invisible in the browser, are visible in the raw query
Cookies with base64-coded roles can be decoded and substituted directly in the title
Server responses with commented prompts or flags are visible in full response
One request can be sent dozens of times with different values via Repeater – without reloading the page
Burp Suite Community Edition is free and contains everything you need for CTF: Proxy, Repeater, Decoder and Intruder (with speed limit). The vulnerability scanner is only in Professional, but it is not needed for CTF. Tasks are solved by hands, through understanding the logic of the application.
Installation of Burp Suite Community Edition
The installer swings from the official website portswigger.net/burp/releases#community. Starting with version 2026.4, PortSwigger uses a single installer for Community and Professional – when you start, select the desired version.
Minimum system requirements: Windows 10+, macOS 10.14+ or any modern Linux distribution, 4 GB RAM (8 GB recommended). Java 17+ is built into the installer – you do not need to put anything separately.
First start: Temporary project → Use Burp defaults → Start Burp. For CTF tasks, a temporary project is enough to keep a story between sessions usually not. Immediately switch the topic to dark: Settings → Display → Theme → Dark. The eyes will thank you after a couple of hours of selection of requests.
Setting up a Burp Suite proxy — step-by-step instructions
Burp Suite proxy by default listens to on 127.0.0.1:8080. It remains to send the browser traffic there. Two ways – choose which is more convenient.
Quick track – Burp browser
In the Proxy tab → Intercept, press Open Browser. The built-in Chromium, already configured to work with Burp, will open: no proxy settings, no certificates. PortSwigger describes it as "preconfigured work to Burp right out of the box."
Minus: This is a separate browser without your bookmarks and extensions. For a quick CTF, a CTF is the perfect option. For constant work, it is better to set up Firefox through FoxyProxy.
Set up FoxyProxy in Firefox
FoxyProxy is an extension for switching the proxy with one button. Without it, you will have to get into the Firefox network settings manually each time.
Installation process:
Open Firefox, go to about:addons
Find FoxyProxy Standard, install
Click on the FoxyProxy icon in the toolbar → Options
Click Add and fill in the fields: Title — Burp Suite, Proxy Type — HTTP, Proxy IP — 127.0.0.1, Port — 8080
Save the configuration
Now switching between the regular Internet and working through Burp is one click on the FoxyProxy icon. Select the “Burp Suite” profile – traffic goes through a proxy. Select “Turn Off” – the browser works directly.
Critical point: While FoxyProxy directs traffic to Burp, and Burp itself is not launched – no site will load. It's not a bug. Run Burp or turn off FoxyProxy.
Installing the Burp Suite SSL Certificate
Without this step, each HTTPS site will show a security error. Burp Suite generates its own CA certificate for the signature of intercepted HTTPS traffic, and the browser must trust it.
Launch Burp Suite, enable FoxyProxy on the “Burp Suite” profile
In the browser, go to http://burp ( HTTP, not HTTPS)
Click CA Certificate — file is downloaded cacert.der
In Firefox: Settings → Privacy and Protection → Scroll to the Certificates block → View Certificates
Certification Centers tab → Import → select downloaded file
Check the “Trust when identifying websites” → OK
Check: Go to any HTTPS site (e.g. google.com). The page is loaded without warnings – the certificate works. In Burp in the Proxy → HTTP history tab you will see decrypted HTTPS requests.
The most common mistake of beginners: everything is configured, HTTP sites work, and HTTPS issues SEC_ERROR_UNKNOWN_ISSUER. The reason is the missed step with the certificate. Without a CA certificate, HTTPS traffic interception in Burp Suite is not possible. The point.
HTTP Queries Interception – First Intercept
Including Interception
In Burp, open the Proxy → Intercept tab
Make sure the switch is on Intercept is on
In the browser (via FoxyProxy on Burp) go to any site
The page will “hang” – that’s normal. Burp delayed the request until your decision. In the Intercept tab, you will see a raw HTTP request: GET or POST method, URL, Host headers, User-Agent, and query body.
Three control buttons:
Forward – send a request further to the server
Drop - destroy the request (the server will not receive it, the action will be canceled)
Intercept is on/off – global interception switch
Press Forward several times until the page is fully loaded. The browser sends dozens of queries to one page: HTML document, CSS-styles, JavaScript files, images, metrics of analytics. Each of them goes through Burp. Yes, it’s exhausting – so it’s about HTTP history.
HTTP History – view without interception
For CTF, constant interception is inconvenient: each request has to be passed manually. Switch Intercept to off and just use the site as usual. All requests are recorded in Proxy → HTTP history.
In history you can:
View every request and response raw
Filter by domain, HTTP method, status code
Search for text inside queries and responses
Send interesting requests to Repeater for modification
PortSwigger documentation says that viewing HTTP history after interacting with the site is "is more convenient in many cases." In practice, this is how you work: first, study the application as an ordinary user - click on links, send forms, log in. Then open HTTP history and analyze the recorded traffic. This is the workflow on the CTF.
Repeater is the main weapon for CTF web tasks
Proxy →Intercept catches requests on the fly. Repeater allows you to take any request, change it and send as many times as required. For web CTF tasks, this is the main working tool. I would say 80% of the decisions are born here.
How to send a request to Repeater
In HTTP history, find the desired request (POST on the login form, GET with interesting parameters)
Right click → Send to Repeater (or Ctrl+R)
Go to the Repeater tab
On the left is a request that can be edited. On the right is the server response. Changed the parameter, pressed Send, studied the answer. Changed again – Send. The browser is not involved.
Typical manipulations for CTF
Cookie substitution is a frequent CTF pattern. The server exhibits a cookie of the type user=guest or isAdmin=false. In Repeater find a title Cookie: and change the meaning. If isAdmin=false replace by isAdmin=true and the server will swallow this without server verification - in front of you Broken Access Control (A01:2021 on OWASP Top 10).
Modification of hidden POST parameters – HTML contains <input type="hidden" name="price" value="100">. In the browser the field is invisible. In Burp Suite you see price=100 in the request body and can be replaced by price=0. The server trusts the data from the client without validation - classics.
HTTP method change – some CTF tasks check how the server responds to GET instead of POST or vice versa. In Repeater, the method changes the editing of the first line of the query. One letter is another result.
Substitution User-Agent – the task can check from which “browser” the request came. Replacement of the User-Agent string with the required value (Admin-Console, a specific version or bot string) solves such problems.
Solving the CTF web task: full disassembly
Let's look at the typical CTF scenario. The pattern is based on common Entry-level CTF platform tasks: parameter substitution and data decoding.
Intelligence: studying requests
Open the CTF task in the browser through Burp-proxy. On the page is a login form with username and password fields. Enter admin / password, get "Access laze". The browser’s DevTools show the standard form – nothing suspicious.
Go to Burp → Proxy → HTTP history. Find a POST request to /login. See the body:
POST /login HTTP/1.1
Host: ctf-challenge.example
Content-Type: application/x-www-form-urlencoded
username=admin&password=password&role=user
Parameter role=user - it was not visible on the page. A hidden form field that the browser sends automatically. In DevTools it can be found, but in the HTML stream it is easy to miss. In Burp, it is visible immediately - in a raw request, you can not hide anything.
Operation via Repeater
Send a request to Repeater (Ctrl+R). Change role=user on role=admin. Pressing the Send.
The server’s response changed: instead of “Access denied” came HTML with the text “Welcome, admin!” and the line flag: Q29kZWJ5X0JTX0ZsYWc=. The server did not check the parameter value role on the backend side – dumbly trusted the client data. Classic Broken Access Control.
Flag decoding via Decoder
The line Q29kZWJ5X0JTX0ZsYWc= ends on = – characteristic feature of Base64. Open the Decoder tab in Burp Suite, paste the line, press Decode as → Base64. The result is the readable text of the flag.
Decoder supports URL coding, HTML-entity, hex, and other formats. In CTF there are multi-level encodings - these dolls: Base64 inside the URL-encode, for example. Decoder allows you to apply decoding sequentially: the result of the first decoding is submitted to the input of the second.
The whole process from opening the task to the flag is 5-10 minutes when you know the algorithm. Without Burp Suite, it would take an hour of picking in DevTools, and the hidden parameter in the POST TV is easy to miss.
Intruder for automated overkill
When you need to check the set of values in one parameter, manual Repeater is slow. Burp Suite Intruder automates too much and will be useful for CTF tasks:
Search for user IDOR vulnerability search ID
Selection of short PIN codes or tokens
Phasing parameters with special symbols
Algorithm of work:
Right click on request → Send to Intruder
Positions tab: highlight the value for the overkill, press Clear §, then Add § around the desired option
Payloads tab: add a list of values manually or download from the file
Start attack
Intruder will show the results table with each payload, status code, and response length. Look for anomalies: If 99 queries gave a response 1200 bytes long and one 3400 bytes, this payload deserves attention in Repeater.
In Community Edition, Intruder is limited in speed – approximately one request per second. For CTF, enough: tasks rarely require a selection of thousands of values. A serious brutforce will require a pro version or external tools like ffuf and hydra.
Beginner mistakes when working with Burp Suite
These problems occur at each first launch. I went through everything myself.
The sites do not open – FoxyProxy directs traffic to Burp, while the Intercept is included. Each request is waiting for Forward to be pressed. Solution: Turn off the Intercept if you don’t need a step-by-step intercept. Traffic is still recorded in HTTP history.
HTTPS issues a certificate error – no Burp Suite CA certificate is installed. Without it, the browser does not trust the signature Burp and blocks the connection. Return to the installation section of the SSL certificate.
HTTP history is clogged with garbage – Burp records absolutely everything: Google Analytics metrics, queries to CDN, Firefox extension updates. Solution: in Target → Scope add the CTF domain platform. In HTTP history, enable the filter “Show only in-scope items.” The trash will be less.
The Internet is “missing” after the closure of Burp – FoxyProxy is still driving traffic to a nonexistent proxy. Click on the FoxyProxy icon → Turn Off. Use to check FoxyProxy first thing when “the Internet does not work.”
Repeater returns an error, although everything worked in the browser - there is no mandatory title in the request. Most often it is a cookie with a session ID or incorrect Content-Type. Compare the request in Repeater with the original in HTTP history – find the differences.
Hotkeys to speed up work
On CTF-competitions time is limited. These combinations save minutes:
Ctrl+R – send a request to Repeater
Ctrl+I – send to Intruder
Ctrl+Shift+R – repeat the last request
Ctrl+F – search inside a query or answer (indispensable for search flag{ or ctf{ in the long server responses)
