Web Application Analysis

burpsuite

burpsuite is the tool most web testers spend their day in. At its heart it’s an intercepting proxy: you route your browser through it, and every request and response passes through Burp where you can read it, pause it, edit it, and replay it. Around that core it stacks a whole workbench — a repeater for hand-crafting requests, an intruder for automated attacks, a decoder, a comparer, and a passive scanner that flags issues as you browse. The Community Edition that ships here covers the manual testing workflow; the commercial edition adds the active scanner and automation.

Because Burp is a graphical Java application, Oniomarchy launches it straight into its window from Security → Web Application Analysis → burpsuite — there’s no terminal help step. Installed from the AUR.

Getting started

The first-run ritual is always the same, and Oniomarchy shortens the slow part of it:

  1. Launch Burp and start a temporary project with the default settings.
  2. Point your browser at it. Burp’s proxy listens on 127.0.0.1:8080 by default. Your hardened Firefox ships with FoxyProxy pre-configured for exactly this.
  3. Trust Burp’s certificate. Intercepting HTTPS needs Burp’s CA in your trust store, and that’s the step everyone forgets. Oniomarchy makes it one menu entry — Trigger → Pentest → Trust Proxy CA — which fetches Burp’s CA and imports it into the system trust store, so Firefox, Chromium, and curl all trust it at once. Burp has to be running for the fetch to work. See Quick Attack Actions.
  4. Browse the target. Requests now flow through Burp; use Proxy → HTTP history to review them and send interesting ones to Repeater or Intruder.

Where it fits

Burp is the hub the rest of this category feeds into. Save a request out of Burp and hand it to sqlmap with -r; or fuzz a parameter you found in Burp with ffuf or wfuzz. If you prefer something lighter, Caido covers the same core workflow.