Proxy

While Burp Suite is a lot more than just a proxy, everything starts with configuring browsers to proxy through Burp. We covered the configuration of proxies extensively in the earlier chapters.

Using Proxy is an integral part of what Burp calls the user-driven workflow. The idea is that Burp sits in the middle of your HTTP client (mostly a browser) and the web server. Have a look at the following diagram:

There are primarily two ways of using Proxy. One is when the interception is turned off and the other when the interception is turned on. Take a look at the following screenshot:

Proxy and, to some extent, Target tools are mainly meant for reconnaissance, mapping, and analysis of the web application being tested.

This doesn't seem as exciting as finding and exploiting vulnerabilities, but as most experienced testers realize with the passage of time, getting this phase correct is extremely important, if not compulsory. When the intercept is off, we are busy interacting with the application...