How to Use Burp Suite for Bug Bounty (Beginner Guide)
Burp Suite is the default intercepting proxy for web hunters. You do not need every scanner module on day one. You need a clean proxy, a habit of reading raw requests, and Repeater.
This guide assumes authorized testing only — labs and in-scope programs.
Install and trust the proxy
- Install Burp Community (or Pro if you have it).
- Set your browser to use
127.0.0.1:8080(or Burp's browser). - Visit Burp's CA page and install the certificate so HTTPS decrypts cleanly.
- Confirm the HTTP history fills when you browse a lab.
If HTTPS sites show certificate errors, fix that before hunting — broken TLS visibility hides half the app.
The only tabs you need at first
- Proxy → Intercept: pause and edit a live request
- HTTP history: everything the browser sent
- Repeater: replay and mutate one request safely
- Target / Site map: the shape of the app
Turn intercept off most of the time. Browse normally, then pull interesting requests from history into Repeater.
A simple daily workflow
- Map the app while logged in as a normal user.
- Note auth cookies, CSRF tokens, and API hosts.
- Pick one feature (profile update, invite, search).
- Send its request to Repeater and change one thing at a time.
- Compare responses — status, length, JSON fields, timing.
One change per attempt beats spraying payloads.
What “interesting” looks like
- IDs in paths or bodies (
/users/123,account_id) - Hidden parameters the UI never shows
- JSON fields like
role,admin,price - File upload and redirect parameters
- Anything that returns another user's data shape
Avoid beginner traps
- Leaving intercept on and wondering why the site “hangs”
- Scanning production with aggressive settings against program rules
- Ignoring scope hosts that appear in JS but not the main domain
- Saving session tokens in screenshots you later publish
Defensive note for teams
Burp traffic is how hunters see your real API. Assume every client field is editable. Authorize on the server.
Master the proxy and Repeater first. Tools multiply skill — they do not replace reading the request.
Original Bugflare guide informed by PortSwigger Burp getting-started documentation.