Most web CTF challenges aren't solved by staring at the page you're given — they're solved by looking at the HTTP requests your browser sends and quietly changing what's in them. Burp Suite is the standard tool for that: it sits between your browser and the target as a proxy, so every request passes through it before it goes out, giving you the chance to read it, edit it, and send it again. This tutorial covers the core workflow — Proxy and Repeater — using nothing beyond Burp Suite's free Community Edition.
1. Route your browser through Burp
Burp listens on 127.0.0.1:8080 by default. Point your browser's HTTP/HTTPS proxy settings at that address — either directly in your browser's network settings, or more conveniently through the FoxyProxy extension, which lets you flip proxying on and off with one click instead of editing settings every time. If the target uses HTTPS, install Burp's CA certificate (available from http://burp while the proxy is active) so your browser stops flagging every request as untrusted.
2. Capture a request
In Burp's Proxy → Intercept tab, turn intercept on. Now perform the action you want to inspect in your browser — submitting a login form, for example. The request stops in Burp instead of reaching the server immediately, showing you the raw HTTP: method, headers, cookies, and body, exactly as your browser built it.
POST /login HTTP/1.1
Host: target.ctf
Content-Type: application/x-www-form-urlencoded
Cookie: session=a1b2c3d4
username=guest&password=guest123&role=user3. Edit it, then forward it
This is the point of the whole exercise: everything in that request is editable text. Change the role parameter, tamper with a cookie value, add a header the client-side JavaScript never sends on its own — whatever the challenge calls for. Click Forward to send your modified version instead of the original, or Drop to discard it. A surprising number of "client-side" checks — hidden form fields, disabled buttons, JavaScript validation — only exist in the browser and are trivially bypassed the moment you control the raw request instead of the page.
4. Iterate fast with Repeater
Intercepting live is useful for a first look, but tweaking the same request over and over through Intercept is slow. Right-click any captured request and choose Send to Repeater (or find it already logged in Proxy → HTTP history). Repeater keeps the request in an editable panel with a "Send" button next to it, so you can change one parameter, send, read the response, change it again, and send again — without ever touching Intercept. It's where most of the actual back-and-forth of solving a web challenge happens.
Wrapping up
Proxy and Repeater alone cover the majority of web CTF challenges: capture what your browser is really sending, edit it, and replay it until the response changes the way you need. Burp Suite's other tools — Intruder for automated parameter fuzzing, Decoder for quick encoding conversions — build on the same captured-request foundation and are worth exploring once this core loop feels natural.