Lion Cipher Lab
Intercept and inspect web traffic with Burp Suite
- Penetration Testing / Red Team
- Beginner
- ~60 min
- Free · no account required
Why it matters
Almost everything you do on the web is a series of HTTP requests: your browser quietly sends a small text message to a server for every login, search, click, and form, and the server sends one back. A web proxy is a tool that sits in the middle of that exchange so you can pause it, read it, and change it — and Burp Suite is the tool the security field reaches for to do exactly that. Being able to put Burp between your browser and an app, freeze a request, understand its parts, and resend a modified copy is the single most assumed skill in web application security: countless external labs on…
What you'll learn
- understanding what an HTTP request is and what a proxy does
- installing Burp Suite Community Edition (the free version) from the official site
- running a deliberately vulnerable practice app on your own machine with one Docker command (OWASP Juice Shop)
- pointing your browser through Burp so every request flows through it
- installing and trusting Burp's CA certificate so HTTPS traffic is readable
- turning on Intercept and freezing a live request before it reaches the server
- reading the anatomy of an HTTP request: method, path, headers, cookies, and body
- sending a request to Repeater to modify and resend it over and over
- browsing the full HTTP history of everything your browser did
- doing all of this strictly on a target you own and run yourself, never on anyone else's site
Steps in this lab
- First, the one rule that makes this legal: your machine, your target, nobody else's
- What an HTTP request and a proxy actually are (from zero)
- Install Burp Suite Community Edition (the free version)
- Run your deliberately vulnerable target on your own machine
- Point your browser through Burp
- Trust Burp's CA certificate so HTTPS is readable
- Turn on Intercept and freeze your first request
- Read the request: method, path, headers, cookies, body
- Replay and modify with Repeater
- Use the HTTP history to see everything at a glance
- What you proved, and where it takes you