timsonner Burp Suite
Purpose
Use this skill for manual, high-signal testing of web applications and APIs once the target surface is understood.
Phase Fit
- Primary: Vulnerability Analysis, Validation and Controlled Impact Demonstration
- Secondary: Retest and Closure
Use When
- Need to inspect authenticated workflows, session handling, or access control.
- Need to confirm business logic issues or request-level trust assumptions.
- Need a clean proof path for a web or API finding.
Avoid When
- Scope, accounts, or approved impact level are still unclear.
- Automated crawling or active checks would exceed the agreed risk tolerance.
Inputs
- Confirmed URLs, roles, and test accounts
- Rules of engagement for state-changing actions
- Sensitive workflows that require caution
Procedure
- Proxy baseline workflows to understand normal behavior.
- Map authentication, authorization, and state transitions.
- Reproduce candidate issues manually and keep the proof path minimal.
- Capture only enough evidence to explain impact and remediation.
- Translate the final proof into precise report language and retest steps.
Command Syntax
Launch syntax varies by installation method. Project and config files are the most useful CLI examples because most testing workflow remains in the UI.
# Standard launch
burpsuite
# Launch with project and scan config files
java -jar /path/to/burpsuite.jar --project-file=contoso.burp --config-file=scan-config.json
# Launch with user options override
java -jar /path/to/burpsuite.jar --project-file=contoso.burp --user-config-file=user-options.json
# Set JVM memory for large engagements
java -Xmx4g -jar /path/to/burpsuite.jar --project-file=contoso.burp
# Upstream proxy configuration (use -Dhttps.proxyHost for JVM proxy chaining)
java -Dhttps.proxyHost=127.0.0.1 -Dhttps.proxyPort=8080 -jar /path/to/burpsuite.jar
Evidence to Capture
- Requests and responses that show the control failure
- Role or workflow differences that establish impact
- Preconditions required for reproduction
Safety Boundaries
- Avoid unnecessary state changes or bulk automation.
- Stop if the workflow touches real user data beyond what is required to prove risk.