# Burp Suite

> Use for manual web and API testing, authenticated workflow review, request replay, and controlled validation during authorized pentests. Trigger on session handling, authorization checks, business logic review, and proof of impact for web findings.

- Skill: `timsonner/burp-suite` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/burp-suite`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/burp-suite/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/burp-suite

---


# Burp Suite

## Purpose

Use this skill for manual, high-signal testing of web applications and APIs once the target surface is understood.

## Phase Fit

- Primary: Vulnerability Analysis, Validation and Controlled Impact Demonstration
- Secondary: Retest and Closure

## Use When

- Need to inspect authenticated workflows, session handling, or access control.
- Need to confirm business logic issues or request-level trust assumptions.
- Need a clean proof path for a web or API finding.

## Avoid When

- Scope, accounts, or approved impact level are still unclear.
- Automated crawling or active checks would exceed the agreed risk tolerance.

## Inputs

- Confirmed URLs, roles, and test accounts
- Rules of engagement for state-changing actions
- Sensitive workflows that require caution

## Procedure

1. Proxy baseline workflows to understand normal behavior.
2. Map authentication, authorization, and state transitions.
3. Reproduce candidate issues manually and keep the proof path minimal.
4. Capture only enough evidence to explain impact and remediation.
5. Translate the final proof into precise report language and retest steps.

## Command Syntax

Launch syntax varies by installation method. Project and config files are the most useful CLI examples because most testing workflow remains in the UI.

```bash
# Standard launch
burpsuite

# Launch with project and scan config files
java -jar /path/to/burpsuite.jar --project-file=contoso.burp --config-file=scan-config.json

# Launch with user options override
java -jar /path/to/burpsuite.jar --project-file=contoso.burp --user-config-file=user-options.json

# Set JVM memory for large engagements
java -Xmx4g -jar /path/to/burpsuite.jar --project-file=contoso.burp

# Upstream proxy configuration (use -Dhttps.proxyHost for JVM proxy chaining)
java -Dhttps.proxyHost=127.0.0.1 -Dhttps.proxyPort=8080 -jar /path/to/burpsuite.jar
```

## Evidence to Capture

- Requests and responses that show the control failure
- Role or workflow differences that establish impact
- Preconditions required for reproduction

## Safety Boundaries

- Avoid unnecessary state changes or bulk automation.
- Stop if the workflow touches real user data beyond what is required to prove risk.