Burp Proxy Firefox
Configuring Firefox to work with Burp – PortSwigger
PROFESSIONAL
Last updated:
October 4, 2021
Read time:
1 Minute
To configure Firefox so that you can use it for testing with Burp, you need to perform the following configuration steps.
In Firefox, go to the Firefox Menu and select “Preferences” / “Options”.
Select the “General” tab and scroll to the “Network Proxy” settings. Click the “Settings” button.
Select the “Manual proxy configuration” option.
Enter your Burp Proxy listener address in the “HTTP Proxy” field (by default this is set to 127. 0. 1).
Next, enter your Burp Proxy listener port in the “Port” field (by default, 8080). Make sure the “Use this proxy server for all protocols” box is checked.
Delete anything that appears in the “No proxy for” field. Then, click “OK” to close all of the options dialogs.
Configuring Firefox to work with Burp – PortSwigger
PROFESSIONAL
Last updated:
October 4, 2021
Read time:
1 Minute
To configure Firefox so that you can use it for testing with Burp, you need to perform the following configuration steps.
In Firefox, go to the Firefox Menu and select “Preferences” / “Options”.
Select the “General” tab and scroll to the “Network Proxy” settings. Click the “Settings” button.
Select the “Manual proxy configuration” option.
Enter your Burp Proxy listener address in the “HTTP Proxy” field (by default this is set to 127. 0. 1).
Next, enter your Burp Proxy listener port in the “Port” field (by default, 8080). Make sure the “Use this proxy server for all protocols” box is checked.
Delete anything that appears in the “No proxy for” field. Then, click “OK” to close all of the options dialogs.
Using Burp Proxy – PortSwigger
PROFESSIONAL
Last updated:
October 6, 2021
Read time:
4 Minutes
The Proxy tool lies at the heart of Burp’s user-driven workflow, and gives you a direct view into how your target application works “under the hood”. It operates as a web proxy server, and sits as a man-in-the-middle between your browser and destination web servers. This lets you intercept, inspect, and modify the raw traffic passing in both directions.
If the application employs HTTPS, Burp breaks the TLS connection between your browser and the server, so that even encrypted data can be viewed and modified within Burp’s tools.
Getting set up
Burp Proxy works in conjunction with the browser that you are using to access the target application. You can either:
Use Burp’s embedded browser, which requires no additional configuration. Go to the “Proxy” > “Intercept” tab and click “Open Browser”. A new browser session will open in which all traffic is proxied through Burp automatically. You can even use this to test over HTTPS without the need to install Burp’s CA certificate.
Use an external browser of your choice. For various reasons, you might not want to use Burp’s embedded browser. In this case, you need to perform some additional steps to configure your browser to work with Burp, and install Burp’s CA certificate in your browser.
When you have things set up, visit any URL in your browser, then go to the “Proxy” > “Intercept” tab in Burp Suite. If everything is working, you should see an HTTP request displayed for you to view and modify. You will need to forward HTTP messages as they appear in order to continue browsing. You should also see entries appearing on the “HTTP history” tab.
Intercepting requests and responses
The Intercept tab displays individual HTTP requests and responses that have been intercepted by Burp Proxy for review and modification. This feature is a key part of Burp’s user-driven workflow:
Manually reviewing intercepted messages is often key to understanding the application’s attack surface in detail.
Modifying request parameters often allows you to quickly identify common security vulnerabilities.
Intercepted requests and responses are displayed in an HTTP message editor, which contains numerous features designed to help you quickly analyze and manipulate the messages.
By default, Burp Proxy intercepts only request messages, and does not intercept requests for URLs with common file extensions that are often not directly interesting when testing (images, CSS, and static JavaScript). You can change this default behavior in the interception options. For example, you can configure Burp to only intercept in-scope requests containing parameters, or to intercept all responses containing HTML.
You may often want to turn off Burp’s interception altogether, so that all HTTP messages are automatically forwarded without requiring user intervention. You can do this using the master interception toggle in the Intercept tab.
Using the Proxy history
Burp maintains a full history of all requests and responses that have passed through the Proxy. This enables you to review the browser-server conversation to understand how the application functions, or carry out key testing tasks. Sometimes you may want to completely disable interception in the Intercept tab, and freely browse a part of the application’s functionality, before carefully reviewing the resulting requests and responses in the Proxy history.
Burp provides the following functions to help you analyze the Proxy history:
The history table can be sorted by clicking on any column header (clicking a header cycles through ascending sort, descending sort, and unsorted). This lets you quickly group similar items and identify any anomalous items.
You can use the display filter to hide items with various characteristics.
You can annotate items with highlights and comments, to describe their purpose or identify interesting items to come back to later.
You can open additional views of the history using the context menu, to apply different filters or help test access controls.
Burp Proxy testing workflow
A key part of Burp’s user-driven workflow is the ability to send interesting items between Burp tools to carry out different tasks. You can do this using the context menus that you can access by right-clicking in various locations throughout Burp.
For example, having observed an interesting request in the proxy, you might want to quickly perform a vulnerability scan of just that request, using Burp Scanner.
You could send the request to Repeater to manually modify the request and reissue it over and over.
You could send the request to Intruder to perform various types of automated customized attacks.
You could send the request to Sequencer to analyze the quality of randomness in a token returned in the response.
You can perform all these actions and various others from the context menus that appear in both the Intercept tab and the Proxy history.
Key configuration options for Burp Proxy
For more specialized testing tasks, or when working with unusual applications, you may need to modify some of Burp Proxy’s numerous options:
You might need to modify the Proxy listener, to bind to different interfaces, redirect requests to different hosts, handle server TLS certificates differently, or support invisible proxying for non-proxy-aware clients.
You can configure the Proxy to automatically modify HTTP responses in various systematic ways; for example, to unhide hidden form fields, remove JavaScript form validation, etc.
You can configure match / replace rules to automatically change the content of requests and responses.
Frequently Asked Questions about burp proxy firefox
How do I use Burp Proxy in Firefox?
Select the “General” tab and scroll to the “Network Proxy” settings. Click the “Settings” button. Select the “Manual proxy configuration” option. Enter your Burp Proxy listener address in the “HTTP Proxy” field (by default this is set to 127.0.Oct 6, 2021
How do you use a Proxy on a burp suite?
Use Burp’s embedded browser, which requires no additional configuration. Go to the “Proxy” > “Intercept” tab and click “Open Browser”. A new browser session will open in which all traffic is proxied through Burp automatically. You can even use this to test over HTTPS without the need to install Burp’s CA certificate.5 days ago
How do I add a burp certificate to Firefox?
From the navigation bar on the left of the screen, open the Privacy and Security settings. Scroll down to the Certificates section and click the View certificates button. In the dialog that opens, go the Authorities tab and click Import. Select the Burp CA certificate that you downloaded earlier and click Open.
