Burp Suite deep testing (GUI + MCP)

When it applies

You're web/API testing an in-scope target (tradecraft-scope-roe; load web-testing-checklist or api-testing-checklist as the coverage map) and need the core manual-testing platform: intercept, modify/replay, targeted enumeration, OOB detection, or an active scan. Burp is name-dropped across many skills as "send it to Repeater" — this one is how to operate it, including agent-driven operation through an MCP extension so the AI can read proxy history and fire Intruder itself.

Why it works

Every request the browser makes flows through Burp's proxy into a searchable history; Repeater gives byte-exact replay, Intruder turns one request into a thousand enumerated variants, Collaborator provides OOB callbacks that prove blind bugs, and the MCP extensions expose all of it as tools — so an agent can triage hundreds of captured requests and only escalate the interesting ones.

Method

1. Set up agent access (MCP). Burp must be running with an MCP extension loaded:
   • Official: Extensions → BApp Store → "MCP Server" (PortSwigger) → Enable (~20 core tools).
   • Community full-coverage extensions expose ~78 tools (full inventory: cheatsheet.md) via an HTTP API on 127.0.0.1:9876 plus a stdio bridge for MCP clients. Health check: curl http://127.0.0.1:9876/health.
   • Never load cracked/repackaged Burp builds — official PortSwigger releases only (Community is fine but rate-limits Intruder hard).
2. Triage proxy history first. Browse the app through the proxy (login, exercise every feature), then work the history: filter by host/path, pull full request/response detail on candidates, regex-search history for secrets (Authorization: Bearer, api_key, JWT shapes). This turns "click around" into a coverage map for the checklist skills.
3. Verify by replay (Repeater). Modify one thing at a time and diff responses — auth headers removed, HTTP method swapped (GET→PUT/DELETE), IDs incremented for web-idor, extra JSON fields for api-mass-assignment, X-Forwarded-For/X-Original-URL for 403 bypasses, path case/traversal variants (/Admin→/admin, ..;/).
4. Enumerate with Intruder. Numeric ranges (OTP/ID enum: code=@@ from 000000–999999), wordlist attacks, cluster-bomb for multi-param cartesian products. Identify hits by response-length difference (e.g. success when length ≠ <error length>) or response time for blind injections. On Community, keep threads low — it throttles to ~1 req/s.
5. Prove blind bugs with Collaborator. Generate a payload, inject it into URL/webhook/redirect params, poll for DNS/HTTP interactions after a few seconds — a callback confirms SSRF/XXE/blind injection that no response diff ever would (web-ssrf).
6. Active scan + targeted fuzzing. Add the target to scope, crawl, then active-scan key requests; treat scanner output as candidates — every issue gets a manual Repeater confirmation (reporting-triage-validation) before it becomes a finding.
7. Automate repetitive transforms with HTTP handlers / match-and-replace: auto-attach auth headers, re-sign requests after reverse-engineering a client signature scheme (web-client-side-signing-bypass), or route through an upstream proxy pool for IP rotation.

Gotchas

• Extension won't load — community MCP extensions are typically compiled for JDK 21+; check Burp's Java version first. Port 9876 already bound = another extension instance running.
• Community Edition throttles Intruder and has no active scanner — plan around it (small targeted lists, manual Repeater loops) or use Pro.
• High thread counts DoS the target and trip WAFs — cap threads, respect roe.md rate limits, and prefer success_length_not-style discrimination over reading every response.
• History ≠ evidence — a suspicious request in proxy history is a lead, not a finding; the finding is the Repeater replay that proves impact.
• Encrypted/signed params — don't fuzz ciphertext; extract or re-implement the transform first, then register it as an auto-handler so Intruder works on plaintext.
• Scope discipline — Burp will happily scan whatever you crawl; keep add_to_scope aligned with scope.txt and never point the active scanner out of scope.

Verify success

Each candidate from history/scanner/Intruder either reproduces in Repeater with a visible impact (diff, data, OOB callback) or is ruled out with the variation matrix worked (per House rules). Confirmed issues are written up per the engagement's findings format with the exact replayed request as proof.

References

PortSwigger Web Security Academy & Burp docs; BApp Store "MCP Server". Tool-by-tool inventory and per-scenario workflows: cheatsheet.md.

---

Portions adapted from reverse-skill by zhaoxuya520, MIT License.