By Jackson Godwin  |  TechTrain Academy  |  Cybersecurity Governance & VAPT Specialist📧 info@jacksontechnology.com 

Every Nigerian bank has a web portal. Every fintech has a mobile API. Every government agency has an online service portal. And every single one of those web applications is a potential attack surface that a malicious hacker — or a professional penetration tester — could exploit.

Web application vulnerabilities are responsible for the majority of data breaches worldwide. SQL injection exposing customer databases. Broken authentication allowing account takeover. Cross-site scripting stealing session cookies. Insecure direct object references exposing other users' data.

Burp Suite is the tool that professional web application penetration testers use to find all of these vulnerabilities — and more. It is the industry standard for web application security testing, used in virtually every professional VAPT engagement involving web applications.

In this guide — Part 4 of the TechTrain Academy Practical Penetration Testing Series — I will teach you Burp Suite from setup to real vulnerability discovery. By the end of this article you will be able to intercept web traffic, manipulate requests, and identify the most critical web application vulnerabilities.

⚠️  LEGAL DISCLAIMER   Only use Burp Suite and web application testing techniques on applications you own, have built, or have EXPLICIT WRITTEN PERMISSION to test. Testing web applications without authorization is illegal and can result in criminal prosecution. All practical exercises in this guide use DVWA (Damn Vulnerable Web Application) — a deliberately vulnerable application designed for learning. Email jacksontechnology05@gmail.com if you have questions about authorized testing.

What is Burp Suite?

Burp Suite is an integrated platform for web application security testing developed by PortSwigger. It works as a proxy — sitting between your browser and the web application — intercepting, analyzing, and manipulating all HTTP/HTTPS traffic flowing between them.

Burp Suite comes in two versions:

• Burp Suite Community Edition — FREE, pre-installed on Kali Linux. Includes all core tools needed for manual testing. This is what we use in this guide.
• Burp Suite Professional — Paid (approx. $449/year). Adds automated scanning, advanced intruder attacks, and additional features used in professional engagements.

Burp Suite Community is Enough to Start   The Community Edition of Burp Suite — which is completely free — provides everything you need to learn web application penetration testing. Professional penetration testers use it for manual testing even when they have the Professional version. Master the Community Edition first — everything you learn transfers directly to the Professional version.

Setting Up Burp Suite — Step by Step

Step 1: Launch Burp Suite

📌  Launch Burp Suite from terminal

# Launch from terminal burpsuite &   # Or find it in Kali Linux menu: # Applications → Web Application Analysis → burpsuite   # Select 'Temporary project' for now # Click 'Start Burp'

Step 2: Configure Your Browser to Use Burp as Proxy

Burp Suite intercepts traffic by acting as a proxy on port 8080. You need to configure your browser to send traffic through it:

📌  Firefox proxy setup (recommended)

# In Firefox: # Settings → General → Network Settings → Manual Proxy   # Set these values: HTTP Proxy: 127.0.0.1    Port: 8080 HTTPS Proxy: 127.0.0.1   Port: 8080 Check: 'Use this proxy server for all protocols'   # Alternative: Use FoxyProxy Firefox extension # Allows quick switching between proxy and direct

Step 3: Install the Burp CA Certificate

To intercept HTTPS traffic (encrypted connections), you must install Burp's Certificate Authority certificate in your browser:

📌  Install Burp CA Certificate

# With Burp proxy running and browser configured: # 1. Browse to: http://burpsuite # 2. Click 'CA Certificate' to download # 3. In Firefox: Settings → Privacy & Security → Certificates # 4. Click 'View Certificates' → 'Authorities' → 'Import' # 5. Select the downloaded certificate # 6. Check 'Trust this CA to identify websites' # 7. Click OK   # You can now intercept HTTPS traffic

Step 4: Set Up DVWA Practice Target

DVWA (Damn Vulnerable Web Application) is a deliberately insecure PHP application designed for learning. Install it as your practice target:

📌  Install DVWA on Kali Linux

# Install required services sudo apt install apache2 mariadb-server php php-mysqli -y   # Start services sudo service apache2 start sudo service mariadb start   # Download DVWA cd /var/www/html sudo git clone https://github.com/digininja/DVWA.git   # Configure database sudo mysql -u root CREATE DATABASE dvwa; CREATE USER 'dvwa'@'localhost' IDENTIFIED BY 'p@ssw0rd'; GRANT ALL ON dvwa.* TO 'dvwa'@'localhost'; FLUSH PRIVILEGES; EXIT;   # Access DVWA in browser: http://127.0.0.1/DVWA # Login: admin / password # Click 'Create / Reset Database'

Understanding the Burp Suite Interface

Burp Suite has several key tools. Here are the most important ones:

🔄

Proxy The heart of Burp Suite. Intercepts all HTTP/HTTPS traffic between your browser and the target application. Every request and response passes through here, where you can view, modify, drop, or forward them. The Proxy is where you observe what the application is doing and identify interesting requests to investigate further. How to use: Go to Proxy → Intercept. Turn intercept ON. Browse the target application — every request will be captured here for you to examine before forwarding.

🔁

Repeater Allows you to take any intercepted request, modify it, and send it again repeatedly. This is where you manually test for vulnerabilities — changing parameters, injecting payloads, and observing how the application responds. Repeater is the most-used Burp tool in manual penetration testing. How to use: Right-click any request in Proxy → Send to Repeater. Modify the request parameters. Click Send. Analyze the response. Repeat with different payloads.

🎯

Intruder Automated attack tool for finding vulnerabilities through systematic payload injection. Used for SQL injection testing, brute-force attacks, parameter fuzzing, and username enumeration. Note: Intruder in Community Edition is rate-limited — the Professional version removes this restriction. How to use: Send request to Intruder. Mark injection points with §payload§. Select attack type (Sniper, Battering Ram, Pitchfork, Cluster Bomb). Configure payload lists. Start attack.

🔍

Scanner Automated vulnerability scanner (Professional Edition only). Crawls and scans web applications for common vulnerabilities. Community Edition does not include the full scanner, but you can perform limited passive scanning. How to use: Professional: Target → Scan. Configure scan settings. Review findings sorted by severity. Community: Use manual testing with Proxy and Repeater instead.

🔐

Decoder Encodes and decodes data in various formats — Base64, URL encoding, HTML entities, hex, and more. Web applications frequently encode data in requests and responses. Decoder helps you understand and manipulate encoded values. How to use: Highlight encoded text anywhere in Burp → Send to Decoder. Select encoding format. Click Decode to reveal the original value.

⚖️

Comparer Compares two requests or responses to identify differences. Extremely useful for identifying how the application behaves differently with different inputs — such as valid vs invalid credentials, or authorized vs unauthorized access attempts. How to use: Right-click any two items → Send to Comparer. Click Compare. View differences highlighted in the results.

The OWASP Top 10 — What You Are Testing For

The OWASP Top 10 is the industry-standard list of the most critical web application security risks. Every web application penetration test covers these vulnerabilities. Here are the most important ones and how to test for them using Burp Suite:

OWASP #A1  —  Broken Access Control   ⚠ CRITICAL

What it is: The most common and most impactful web vulnerability. Occurs when users can access functionality or data they should not be allowed to access — such as viewing other users' account details, accessing admin functions without admin privileges, or accessing resources by manipulating IDs in URLs. How to test with Burp Suite: In Burp Proxy, intercept requests that include user IDs, account numbers, or resource identifiers. Send to Repeater. Change the ID to another user's ID (e.g. change userId=123 to userId=124). If the application returns the other user's data — this is Broken Access Control (also called IDOR — Insecure Direct Object Reference). Real-world impact: Attacker can view any user's personal data, financial records, medical history. Can perform actions as other users including administrators. One of the most common critical findings in Nigerian bank and fintech penetration tests.

OWASP #A3  —  SQL Injection   ⚠ CRITICAL

What it is: SQL injection occurs when user-supplied input is incorporated into database queries without proper sanitization. An attacker can manipulate the query to retrieve unauthorized data, bypass authentication, modify data, or in some cases execute system commands. How to test with Burp Suite: In Burp Repeater, find any parameter that interacts with a database (login fields, search boxes, URL parameters). Add a single quote to the value (e.g. admin'). Observe the error response. Try classic payloads: ' OR '1'='1 for authentication bypass. Use sqlmap for automated detection: sqlmap -u 'http://target.com/page?id=1' --dbs Real-world impact: Complete database compromise — attacker can extract all usernames, passwords, financial data, and personal information. Authentication bypass allowing login as any user including admin. In Nigerian banking systems, SQL injection can expose millions of customer records.

OWASP #A2  —  Cryptographic Failures   ⚠ HIGH

What it is: Occurs when sensitive data is not properly protected — transmitted without encryption, stored with weak hashing, or using outdated cryptographic algorithms. This includes sending passwords over HTTP instead of HTTPS, storing passwords in plain text, or using MD5 for password hashing. How to test with Burp Suite: In Burp Proxy, check if login forms are submitted over HTTP (not HTTPS). Look for sensitive data in URL parameters (passwords, tokens, personal information should never be in URLs). Check response headers for: Strict-Transport-Security, X-Content-Type-Options. Look for sensitive information in cookies — are they marked Secure and HttpOnly? Real-world impact: Customer passwords, credit card numbers, and personal data transmitted or stored insecurely. Man-in-the-middle attacks intercepting login credentials. Session tokens stolen from insecure cookies.

OWASP #A7  —  Cross-Site Scripting (XSS)   ⚠ HIGH

What it is: XSS allows attackers to inject malicious JavaScript into web pages viewed by other users. The injected script runs in the victim's browser with full access to the page — allowing theft of session cookies, redirection to phishing sites, keylogging, and more. How to test with Burp Suite: In Burp Repeater, find any input field that displays your input back on the page (search fields, comment boxes, profile names). Inject basic XSS payload: <script>alert('XSS')</script>. If an alert box appears — reflected XSS confirmed. Also try: <img src=x onerror=alert('XSS')>. Check if your payload is reflected without encoding. Real-world impact: Session cookie theft allowing account takeover without knowing the password. Redirecting users to phishing pages that look identical to the real site. Keylogging capturing everything users type. Particularly dangerous in Nigerian banking portals where stealing a session cookie gives access to the victim's bank account.

OWASP #A4  —  Insecure Design   ⚠ HIGH

What it is: Security flaws in the design of the application — not implementation bugs but fundamental design decisions that create security risks. Examples include password reset mechanisms that are easily abused, rate limiting not implemented on sensitive functions, or security questions that are easily guessable. How to test with Burp Suite: Test password reset flows: Does the reset link expire? Can you request multiple reset links? Does the application reveal whether an email exists? Test login brute-force: Use Burp Intruder to send 100 login attempts — does the account lock? Test for predictable reset tokens — are they sequential or time-based? Check if security-sensitive functions have CAPTCHA. Real-world impact: Account takeover through password reset abuse. Credential stuffing attacks succeeding due to no rate limiting. Automated attacks against login pages succeeding without lockout mechanisms.

OWASP #A9  —  Security Logging Failures   ⚠ MEDIUM

What it is: Applications that fail to log security-relevant events — failed logins, access control failures, SQL injection attempts — cannot detect breaches, cannot investigate incidents, and cannot demonstrate compliance. Attackers can operate inside vulnerable applications for months without detection. How to test with Burp Suite: Check if the application logs failed login attempts (test with wrong credentials and see if there is any indication of logging). Attempt obvious attacks (SQL injection, XSS) and check if they are detected. Ask the client if they review their application logs regularly and if they have alerting on suspicious patterns. Real-world impact: Attackers can operate undetected for extended periods. Impossible to investigate incidents after the fact. Non-compliance with regulations requiring audit trails including CBN guidelines and NDPR.

Practical Exercise — Finding SQL Injection in DVWA

Let us put Burp Suite into practice with a real SQL injection exercise in DVWA:

Before You Begin   Ensure DVWA is running at http://127.0.0.1/DVWA and Burp Suite is configured as your browser proxy. Set DVWA Security Level to 'Low' under DVWA Security settings.

📌  SQL Injection Exercise in DVWA

# Step 1: Navigate to DVWA SQL Injection page # http://127.0.0.1/DVWA/vulnerabilities/sqli/   # Step 2: Turn ON Burp Proxy Intercept # Proxy → Intercept → Intercept is on   # Step 3: Enter ID '1' in the form and click Submit # Burp captures the request — forward it   # Step 4: Enter ' (single quote) and Submit # Observe the SQL error — confirms SQL injection   # Step 5: Send the request to Repeater # Right-click → Send to Repeater   # Step 6: In Repeater, modify the id parameter: id=1' OR '1'='1 # Click Send — should return ALL user records   # Step 7: Try UNION injection to get database info: id=1' UNION SELECT 1,database()-- # Returns the database name   id=1' UNION SELECT 1,user()-- # Returns the database user   # Step 8: Use sqlmap for automated exploitation sqlmap -u 'http://127.0.0.1/DVWA/vulnerabilities/sqli/?id=1&Submit=Submit' --cookie='PHPSESSID=YOUR_SESSION;security=low' --dbs

Burp Suite Workflow — Professional Web App Testing

In a real penetration testing engagement, here is the professional workflow for web application testing with Burp Suite:

• Step 1 — Spider/Crawl: Map all pages, forms, and endpoints using Burp's crawl function or manual browsing with Proxy active
• Step 2 — Passive Analysis: Review all captured traffic in Proxy History for sensitive data in requests/responses
• Step 3 — Authentication Testing: Test login, password reset, session management, and access controls
• Step 4 — Input Validation Testing: Test all input fields for SQLi, XSS, and command injection using Repeater
• Step 5 — Business Logic Testing: Test application workflows for logical flaws — can you skip steps? Access other users' data?
• Step 6 — API Testing: Test any API endpoints discovered for authentication flaws and injection vulnerabilities
• Step 7 — Documentation: Screenshot all findings with request/response evidence for the final report

Jackson Godwin's Burp Suite Tip: The most valuable habit I developed in web application testing is spending the first 30 minutes of any engagement simply browsing the entire target application with Burp Proxy active — without intercepting anything, just letting it all flow through and building the site map. This gives you a complete picture of the attack surface before you start actively testing anything.  Every form, every URL parameter, every API endpoint that appears in the Proxy History is a potential test target. Only after you have mapped the complete surface do you go back and start systematically testing each one.  Questions? Email: jacksontechnology05@gmail.com

Conclusion — The Web is Your Testing Ground

Web application vulnerabilities are everywhere — in Nigerian banking portals, government service platforms, fintech applications, and e-commerce sites. Every organization with a web presence has an attack surface that needs to be tested.

Burp Suite is your primary tool for that testing. Master the Proxy for traffic interception. Master Repeater for manual testing. Understand the OWASP Top 10 so you know what you are looking for. Practice relentlessly on DVWA until using Burp Suite is second nature.

In Part 5 of this series, we move to Metasploit Framework — the most powerful exploitation tool in a penetration tester's arsenal, and the tool that takes you from finding vulnerabilities to proving their exploitability.

Questions about Burp Suite or web application testing? Email Jackson Godwin at jacksontechnology05@gmail.com. He personally responds to all student questions.

Master Web Application Penetration Testing   TechTrain Academy's Ethical Hacking & VAPT program covers Burp Suite and full web application testing methodology in a hands-on lab environment. Train with real-world vulnerable applications using the same techniques used in professional VAPT engagements.   Enroll Now | Email: jacksontechnology05@gmail.com | Visit TechTrain Academy

Questions about this tutorial?   📧  info@jacksontechnology.com   Jackson personally responds to student questions. Enroll in TechTrain Academy for full hands-on training with live instructor support.

⬅  PREVIOUS Part 3: Reconnaissance & OSINT

NEXT  ➡ Part 5: Metasploit Framework

About the Author   Jackson Godwin is a Cybersecurity Governance & VAPT Specialist and founder of TechTrain Academy. With over 40 web and mobile application security assessments conducted across Nigerian financial institutions, government agencies, and enterprises, Jackson brings real-world web application penetration testing experience to every tutorial. Questions? Email: info@jacksontechnology.com

TAGS: Burp Suite tutorial Nigeria, web application penetration testing Nigeria, OWASP Top 10 Nigeria, SQL injection tutorial, XSS tutorial, how to use Burp Suite, TechTrain Academy, info@jacksontechnology.com, Jackson Godwin VAPT