Burp Suite Cheat Sheet

Burp Suite sits between your browser and a target as an intercepting proxy, letting you see, modify, and replay every request before it goes out. Burp Suite Fundamentals covers the core Proxy → Repeater → Intruder workflow; this is the quick-reference layer on top of it — the shortcuts and secondary tabs that speed up work once the basic flow is second nature.

Red Team / Offensive Use

Almost every manual web application test runs through Burp at some point, even ones that end up using a dedicated tool like sqlmap or ffuf for the actual exploitation step — Burp is how you first see the request worth attacking, and Repeater is how you confirm a payload works before scripting it. Scope configuration specifically matters on real engagements: an unscoped Burp instance intercepts and logs everything your browser touches, including sites outside the authorized target, which is both noisy and a real liability if that traffic ever needs to be reviewed later.

Established Cheatsheet

PortSwigger Web Security Academy — Burp's own vendor, and the standard free resource for both the tool and the underlying web vulnerability classes it's used to find.

PWNMI's Top 7 Use Cases

• Target → Scope — restrict Proxy history and Target/Site map to the authorized domain(s) before doing anything else; everything else in Burp gets noticeably more usable once out-of-scope noise is filtered out
• Ctrl+R (Repeater, with a request selected anywhere in Burp) — send straight to Repeater without the right-click menu, the single most-used shortcut once it's muscle memory
• Decoder tab — quick encode/decode (Base64, URL, hex, HTML entities) without leaving Burp or reaching for an external tool; also does smart auto-detect on pasted text
• Comparer — diff two requests or responses side by side at the byte level, useful for spotting a subtle difference a visual scan would miss (an authorization check that silently changes behavior between two near-identical requests, for example)
• Intruder payload positions and attack types — Sniper (one payload set, one position at a time) covers most single-parameter fuzzing; Cluster bomb (multiple payload sets, every combination) is the one to reach for when testing two independent parameters together, like a username/password pair
• Proxy → Match and Replace — auto-modify requests or responses matching a rule as they pass through, useful for persistently injecting a header (an auth token, a custom X-Forwarded-For) across every request without editing each one by hand
• Logger (or the Proxy HTTP history search bar) — full-text search across every request/response Burp has seen in the session, faster than scrolling history looking for where a specific parameter first showed up

Next step

New to Burp entirely? Start with Burp Suite Fundamentals for the core Proxy/Repeater/Intruder workflow this builds on. For the vulnerability classes worth testing for once you're intercepting traffic, see sqlmap and ffuf.