Burp Suite recon workflow

Objective

Build the safe lab boundaries (browser profile, isolated network, scope filter), then capture and document a single HTTP request/response pair as reusable evidence.

Prerequisites

• Docker installed and running locally.
• A separate browser profile reserved for lab work only.
• Written scope: the lab target must be a system you own or an explicitly authorized training app.

Environment

• Target: a local vulnerable app (for example OWASP Juice Shop) reachable at http://127.0.0.1:3000.
• Burp Suite Community on 127.0.0.1:8080 (proxy listener bound to localhost only).
• Lab browser profile pointed at the Burp proxy; your daily profile stays proxy-free.

Steps

1. 1

   Isolate the target

   Run the training app on an isolated Docker network with no bridge to your host services. Confirm the only port you expose is the one the browser needs.

2. 2

   Bind the proxy and set scope

   Limit the Intercept listener to scope, and add only the local target to Target → Scope. Scope filters history and tool behavior; it is not a firewall, so the network isolation from step 1 is what actually keeps traffic in.

3. 3

   Capture one request/response pair

   Walk the login flow once with Intercept off, then replay a single request in Repeater. Save the full request (headers included) and the relevant slice of the response as one evidence record.

4. 4

   Write the finding record

   Use the fixed finding format (target, method, parameter, expected vs observed, impact, fix idea) so the same note supports a report later. A screenshot alone is not evidence; the request pair is.

How to verify

• Only the target-owner’s own host responds on the exposed port.
• No request in the Burp history points outside the lab.
• The saved finding contains a reproducible request/response pair plus a one-line impact.