An intercepting proxy sits between your browser and the target so you can see and rewrite every request. It is the single most important tool in web testing.

Setup

1. Start the proxy listener (Burp defaults to 127.0.0.1:8080).
2. Point the browser at it — a dedicated pre-configured browser is easiest.
3. Install the proxy's CA certificate so HTTPS can be inspected.
4. Set the target scope so you only log traffic you are testing.

Core workflow

• HTTP history — every request is logged; filter by host, MIME type, status.
• Repeater — send one request repeatedly with tweaks. Most manual testing happens here.
• Intruder / fuzzer — automate a request with payload lists and diff the responses.
• Decoder / comparer — encode and decode Base64, URL, hex; diff two responses byte by byte.

Exercise

Log in to any practice lab, find the login request in HTTP history, send it to Repeater, and replay it with a wrong password. Note exactly how the response differs — length, status, body text. That diff is the basis of nearly every authentication and injection test.