After this lesson, you will be able to: Navigate every Burp panel a professional uses daily: Dashboard, Target, Proxy, Intruder, Repeater, Decoder, Comparer, Logger, Sequencer, and Extensions.
Burp has many tabs, and knowing what each is for is half the skill. This lesson tours the panels you will use throughout the subtrack so the later lessons can focus on technique rather than where things are.
The Dashboard shows active scans (Pro), the event log, and issue activity. Target holds the site map (a tree of every host and path Burp has seen) and the scope configuration. Scope is critical: it defines which hosts you are allowed to test, so you do not accidentally send traffic at things you should not. Setting scope early keeps your work focused and safe.
Proxy is where interception and HTTP history live. Repeater lets you manually craft and resend a single request as many times as you want while reading the full response, the heart of manual testing. Intruder automates customized attacks by sending a request repeatedly with different payloads at marked positions. You will spend most of your time in these three.
Decoder encodes and decodes data (Base64, URL, HTML, hex, gzip), invaluable for reading tokens and crafting payloads. Comparer diffs two requests or responses to spot subtle differences (for example, the response to a valid vs invalid username). Sequencer analyzes the randomness of tokens like session IDs and CSRF tokens to see whether they are predictable.
Logger (Professional) is a full searchable traffic log across all tools. Extensions (formerly Extender) is the BApp Store plus your own custom extensions in Java or Python. As you tour these, note which are Pro-only (Scanner, Logger) so you know what Community offers. You do not need to master each now; you need to know what exists and where to find it.
Pick one.
Never setting scope, so the site map and history fill with noise from third-party domains. Confusing Repeater (manual, one request) with Intruder (automated, many payloads). Overlooking Decoder and re-encoding payloads by hand. Forgetting Comparer when a tiny response difference is the whole tell. Assuming a feature is missing when it is simply a Professional-only tab.
Sign in and purchase access to unlock this lesson.