Burp Suite Web Application Security Testing Training Course

Course overview

Web applications expose business processes, customer data and internal services through complex combinations of APIs, authentication flows, browser behaviour and third-party components. Security professionals need more than a vulnerability checklist: they must intercept realistic traffic, identify flawed trust boundaries, prove exploitability safely and explain the risk in terms developers and system owners can act on. This course gives participants a structured way to use Burp Suite for repeatable web application security testing.

Participants configure Burp Suite Professional, map an application's attack surface and work through the full testing workflow: proxying traffic, analysing requests and responses, managing scope, testing authentication and session handling, manipulating parameters, identifying injection and access-control weaknesses, and testing APIs. They use Repeater, Intruder, Scanner, Decoder, Comparer, Sequencer and Collaborator to investigate findings. The course also connects technical evidence to OWASP Top 10 categories, CWE references and CVSS-based prioritisation.

Training is delivered through instructor-led demonstrations and guided work in deliberately vulnerable web applications and APIs. Participants progressively build a test record containing target scope, endpoint inventory, captured evidence, reproduction steps, severity rationale and remediation recommendations. The final practical exercise requires each participant to conduct a time-boxed assessment in Burp Suite and produce a concise, defensible web security test report suitable for handover to an engineering or risk team.

The course is designed for practitioners who need practical Burp Suite capability rather than a purely theoretical introduction to application security. It is particularly useful for security analysts moving into web testing, developers with security responsibilities, penetration testers seeking a disciplined Burp workflow, and technical assurance staff who must validate supplier or internal application controls.

Course objectives

By the end of this course, participants will be able to:

• Configure Burp Suite Professional projects, proxy settings, TLS interception and target scope for an authorised assessment
• Map an application's attack surface by crawling, browsing and organising endpoints in the Burp Suite site map
• Analyse HTTP requests, responses, cookies and headers to identify client-server trust assumptions
• Test authentication, session management and access control using Repeater, Sequencer and controlled account comparisons
• Construct and refine Intruder payload attacks to investigate input validation, enumeration and rate-limit weaknesses
• Validate suspected injection, cross-site scripting and request-forgery flaws with reproducible Burp Suite evidence
• Use Burp Collaborator and out-of-band testing methods to detect blind server-side interactions safely
• Produce a prioritised web application security test report with CVSS rationale, CWE references and remediation guidance

Benefits of attending

Target competencies

Who should attend

• Cyber Security Analysts — who need to validate web application findings rather than rely solely on automated alerts
• Penetration Testers — who require a disciplined Burp Suite workflow for authorised application assessments
• Application Security Engineers — who support secure development teams and investigate vulnerabilities before release
• Software Developers — who need to reproduce, understand and remediate security defects in their own web applications
• Quality Assurance Engineers — who add security-focused test cases to functional and regression testing
• IT Risk and Technical Assurance Professionals — who must assess evidence of web control effectiveness and supplier risk

Requirements and prerequisites

Participants should be comfortable using a laptop, browser developer tools and basic command-line utilities. They need a working understanding of HTTP and HTTPS concepts, including URLs, methods, headers, cookies, request parameters, status codes and JSON; familiarity with HTML forms and browser sessions is useful. Some experience of web application development, testing or security operations will help participants interpret findings. This is foundation to intermediate training, so prior penetration-testing experience, coding expertise, Burp Suite experience and security certifications are not required. Complete beginners should expect to spend time reinforcing web terminology before undertaking the practical labs.

Training methodology

The instructor alternates focused demonstrations in Burp Suite Professional with guided exercises against isolated, deliberately vulnerable web applications and APIs. Participants intercept and modify live lab traffic, compare authorised user roles, build payload sets, validate scanner leads and capture evidence for reports. Short case discussions examine why findings matter to developers and system owners, including false-positive triage and responsible testing boundaries. Daily exercises add sections to a personal assessment record. On day five, participants complete a time-boxed test and prepare an application plan for their own authorised testing workflow.

Course outline

Day 1: Burp Suite setup and web attack-surface mapping

• Authorised testing boundaries, rules of engagement and safe handling of test data
• HTTP, HTTPS, cookies, sessions and JSON request fundamentals
• Burp Suite Professional interface, project files and configuration options
• Proxy listener configuration and browser TLS certificate installation
• Target scope definition, logging controls and exclusion rules
• Intercepting, forwarding, dropping and editing requests in Proxy
• Site map construction through browsing, crawling and content discovery

Workshop: Participants configure a Burp project for a vulnerable application and produce a scoped site map with an initial endpoint inventory.

Day 2: Manual request analysis and authentication testing

• Reading request methods, headers, bodies, status codes and response differences
• Repeater workflows for controlled request manipulation and replay
• Decoder and Comparer for encoding analysis and response comparison
• Authentication flow mapping and password-reset workflow testing
• Cookie attributes, token handling and session fixation indicators
• Sequencer analysis of session token randomness
• Role-based access-control testing with horizontal and vertical privilege comparisons

Workshop: Participants use two authorised accounts and Repeater to document an access-control test, including evidence of any object-reference weakness.

Day 3: Input validation, automation and client-side flaws

• Input-point identification across query strings, forms, JSON and multipart requests
• Intruder attack types, payload positions and request throttling
• Payload processing, grep extraction and response-based result filtering
• SQL injection indicators and safe manual validation techniques
• Reflected, stored and DOM-based cross-site scripting testing approaches
• File upload, path traversal and command-injection test design
• Burp Scanner configuration, scan auditing and false-positive triage

Workshop: Participants design an Intruder attack and Repeater validation sequence, then produce an evidence pack for one confirmed input-validation finding.

Day 4: API, server-side and out-of-band security testing

• REST and JSON API endpoint discovery in Burp Suite
• API authentication with bearer tokens, API keys and signed requests
• Testing mass assignment, excessive data exposure and broken object-level authorisation
• Content-type manipulation and deserialisation risk indicators
• Server-side request forgery test cases and controlled payload placement
• Burp Collaborator clients, polling and out-of-band interaction evidence
• WebSockets, CORS policies and browser-origin trust boundaries

Workshop: Participants test a vulnerable API and use Burp Collaborator to capture controlled out-of-band evidence for a server-side interaction.

Day 5: Reporting, prioritisation and repeatable assessment practice

• Classifying findings with OWASP Top 10 and CWE references
• CVSS v3.1 scoring assumptions and business-context adjustments
• Writing clear vulnerability descriptions, impact statements and reproduction steps
• Creating developer-focused remediation guidance and retest criteria
• Burp Suite issue management, annotations and evidence export
• Time-boxed assessment planning, test coverage and testing limitations
• Retesting fixes and communicating residual risk to stakeholders

Workshop: Participants complete a time-boxed Burp Suite assessment and produce a prioritised report with findings, evidence, remediation actions and stated test limitations.

Tools & standards covered

Burp Suite Professional, Burp Collaborator, OWASP Top 10 2021, CVSS v3.1

A typical training day

Live online deliveries follow the same structure in the East Africa Time zone, with shorter screen blocks and longer breaks.

What the fee includes

How you can take this course

Certification

Participants who complete the full five days receive the Skillset Development Certificate of Completion, stating the course title, course code, dates and delivery format — suitable for professional-development records and employer reimbursement.

Frequently asked questions