Intercepting Your First Request with Burp Suite Community Edition on Windows

Intercepting Your First Request with Burp Suite Community Edition on Windows

By the end of this guide, you will have a working Burp Suite setup that intercepts, freezes, and forwards live web traffic. This is the foundational skill every web app security exercise afterward depends on.

Prerequisites

Windows 11 Pro (64 bit), Burp Suite Community Edition installed. No prior networking or proxy experience required.

Steps

1. Launch Burp, choose Temporary Project, use Burp defaults, and click Start Burp.
2. Confirm the proxy listener is active. Go to Proxy → Proxy Settings and check that 127.0.0.1:8080 is enabled.
3. Open Burp’s built in browser. Go to Proxy → Intercept → Open Browser. This avoids manual proxy and certificate setup entirely, which makes it the simplest starting point for a beginner.
4. Turn Intercept on.
5. Visit a test site, for example http://example.com, and watch the request freeze in Burp.
6. Forward the request in the Intercept tab and confirm the page loads.
7. Check Proxy → HTTP History to see the logged request.

Verification

The frozen raw HTTP request appears in the Intercept tab. After forwarding, the same request shows up in HTTP History with the full request and response detail.

Troubleshooting

If the site does not freeze in Intercept, the most common cause is browser cache. If you have visited the site before in the same browser session, it may load from cache instead of sending a new network request. Fix this by disabling cache in DevTools (F12 → Network → Disable cache), doing a hard reload with Ctrl+Shift+R, or clearing browser history and cache.
Intercept and Intruder are easy to confuse. Intercept, under the Proxy tab, freezes live traffic. Intruder is a separate tool for automated attacks and shows nothing unless you send a captured request to it manually.
Testing against major sites like Google can trigger CAPTCHA or bot detection pages, since proxied traffic looks suspicious to sites with strong bot protection. Stick to neutral test domains like example.com while learning.

Written while learning web application security. More tutorials from this journey coming soon.