Starting Burp at a command line or as an executable

For non-Windows users or those Windows users who chose the plain JAR file option, you will start Burp at a command line each time they wish to run it. As such, you will require a particular Java command to do so.

In some circumstances, such as automated scripting, you may wish to invoke Burp at the command line as a line item in your shell script. Additionally, you may wish to run Burp without a graphical user interface (GUI), referred to as headless mode. This section describes how to perform these tasks.

How to do it...

We will review the commands and actions required to start the Burp Suite product:

1. Start Burp in Windows, after running the installer from the downloaded .exe file, by double-clicking the icon on desktop or select it from the programs listing:

When using the plain JAR file, the executable java is followed by the option of –jar, followed by the name of the download JAR file.

2. Start Burp at the command line (minimal) with the plain JAR file (Java must be installed first):

If you prefer more control over the heap size settings (that is, the amount of memory allocated for the program) you may modify the java command.

3. The java executable is followed by the –jar, followed by the memory allocation. In this case, 2 GB (that is, 2g) is allocated for read access memory (RAM), followed by the name of the JAR file. If you get an error to the effect that you cannot allocate that much memory, just drop the amount down to something like 1,024 MB (that is, 1024m) instead.
4. Start Burp at command line (optimize) with the plain JAR file (Java must be installed first):

5. It is possible to start Burp at the command line and to run it in headless mode. Headless mode means running Burp without the GUI.

For the purposes of this book, we will not be running Burp in headless mode, since we are learning through the GUI. However, you may require this information in the future, which is why it is presented here.

6. Start Burp at the command line to run in headless mode with the plain JAR file (Java must be installed first):

Note the placement of the parameter -Djava.awt.headless=true immediately following the -jar option and before the name of the JAR file.

7. If successful, you should see the following:

Press Ctrl + C or Ctrl + Z to stop the process.

8. It is possible to provide a configuration file to the headless mode command for customizing the port number and IP address where the proxy listener is located.

Please consult PortSwigger's support pages for more information on this topic: https://support.portswigger.net/customer/portal/questions/16805563-burp-command-line.

9. In each startup scenario described, you should be presented with a splash screen. The splash screen label will match whichever edition you decided to download, either Professional or Community.
10. You may be prompted to update the version; feel free to do this, if you like. New features are constantly added into Burp to help you find vulnerabilities, so upgrading the application is a good idea. Choose Update Now, if applicable.
11. Next, you are presented with a dialog box asking about project files and configurations:

12. If you are using the Community edition, you will only be able to create a temporary project. If you are using the Professional edition, create a new project on disk, saving it in an appropriate location for you to find. Click Next.

13. The subsequent splash screen asks you about the configurations you would like to use. At this point, we don't have any yet, so choose Use Burp defaults. As you progress through this book, you may wish to save configuration settings and load them from this splash screen in the future, as follows:

14. Finally, we are ready to click Start Burp.

How it works...

Using either the plain JAR file or the Windows executable, you can launch Burp to start the Proxy listener to capture HTTP traffic. Burp offers temporary or permanent Project files to save activities performed in the suite.