Wondering why half the traffic in your proxy history shows up as a wall of red errors the moment you open a modern app? Nine times out of ten, it’s not the tool — it’s the setup. Burp Suite is still the reference point for hands-on web security testing, but a rushed install produces a proxy that can’t read HTTPS, can’t see mobile apps, and can’t be trusted for real assessment work. This guide walks through a clean, repeatable setup: installer choices, Java prerequisites, CA certificate trust, browser configuration, and the project settings that save hours later.
Start With the Right Edition and a Java Check
Before touching an installer, decide which edition you need. Burp Suite Community Edition is free and covers manual testing with the Proxy, Repeater, and Decoder tools, though it throttles automated scanning and drops some Intruder speed. Burp Suite Professional includes the scanner, faster Intruder, and the BApp extensions that most testers rely on daily. Burp Suite Enterprise Edition is the CI/CD-oriented product for teams running scheduled scans across an application portfolio.
| Edition | Best for | Key limitation |
|---|---|---|
| Community | Learning, manual testing, bug bounty triage | Throttled Intruder, no scanner |
| Professional | Full manual and automated assessments | Paid licence |
| Enterprise | Teams, continuous scanning in pipelines | Separate deployment model |
Burp is a Java application, so a compatible Java runtime must be present before the installer will run. The exact minimum version moves with each release, so check the current requirement on the official Burp Suite downloads page rather than trusting a tutorial written a year ago. A common mistake is installing Burp on a machine with an ancient JRE left over from another tool, then blaming the installer when it silently fails. Verify Java first with a version check in a terminal, and install a current JDK if the output looks stale.
Download and Install on Windows, macOS, or Linux
PortSwigger distributes native installers for all three major platforms, plus a shell script for Linux. Grab the build from the official Burp Suite releases page so you get the current version and its release notes.
- Windows: run the `.exe` installer, accept the default install path, and let it create a Start menu entry. If Windows SmartScreen flags the unsigned installer, verify the download came from PortSwigger before proceeding.
- macOS: open the `.dmg`, drag Burp Suite into Applications, and approve the app on first launch under System Settings > Privacy & Security if Gatekeeper blocks it.
- Linux: make the installer script executable, run it, and follow the prompt for an install directory. Installing to `/opt` keeps it out of your home folder and makes multi-user setups cleaner.
One practical tip that saves grief later: install Burp to a path without spaces or unusual characters, especially on Windows. Some extensions and helper scripts mishandle quoted paths, and the resulting errors are cryptic.
Create a Project and Choose Your Settings
On first launch, Burp asks whether to open a temporary project or a new project on disk. Temporary projects live in memory and vanish on exit — fine for a quick look, terrible for real work. Choose a project on disk, name it after the target and date, and pick a location you back up.
This is also where you select a configuration file. Burp lets you save the entire tool configuration — proxy listeners, target scope, session handling rules, extension settings — and reload it later. For anyone testing the same application repeatedly, that saved config is the single biggest time-saver in the whole setup. Build one good baseline config, export it, and reuse it.
If you’re running Burp alongside other tooling on a modest laptop, keep an eye on memory. The JVM heap can be raised at launch, and a busy proxy history on a large app will consume it quickly. Clearing the proxy history between sessions is cheaper than restarting.
Configure the Proxy Listener Correctly
Burp’s Proxy tab is where most setup problems originate. By default, Burp listens on 127.0.0.1:8080. That binding only accepts connections from the local machine, which is the safe default. If you need a phone or another device to route through Burp, add a new listener bound to all interfaces and restrict it to your LAN — never expose a proxy listener to an untrusted network, because anyone who can reach it can read and modify their own traffic through your machine.
A few listener settings worth changing immediately:
- Bind to loopback only unless you specifically need remote devices.
- Enable invisible proxying for clients that ignore system proxy settings, such as some thick clients and mobile apps.
- Redirect to host and port if you want a single listener to handle both HTTP and HTTPS cleanly.
Then set your browser or OS to use `127.0.0.1:8080` as the HTTP and HTTPS proxy. Burp’s built-in Chromium browser skips this step entirely — it’s preconfigured to route through Burp, which removes a whole class of “why is nothing appearing” confusion. For beginners, that embedded browser is the fastest path to seeing traffic.
Install the CA Certificate So HTTPS Decrypts
Here’s the step almost everyone gets wrong. Browsers encrypt HTTPS, so Burp cannot read it unless it performs a man-in-the-middle handshake with its own certificate. Burp generates a unique CA certificate per installation, and you must tell your browser or operating system to trust it.
The workflow:
- With the proxy running, browse to ` in the proxied browser.
- Download the CA certificate from that page.
- Import it into your browser’s or OS’s trusted root store.
- Restart the browser and confirm HTTPS sites load without certificate warnings.
On Firefox, the certificate goes into the browser’s own store, not the system store — a frequent source of confusion on machines where Chrome works and Firefox doesn’t. On macOS and Windows, adding it to the system keychain or certificate store covers most applications at once. On Android, user-installed certificates are ignored by many apps on recent versions, which is why mobile testing often needs a rooted device or a debuggable build. (Apple scotus 27 percent app store fee 2026)
The official Burp Suite documentation covers the certificate export and trust steps in detail for each platform, and it’s worth reading the current version because the UI paths shift between releases.
Common mistakes to avoid:
- Trusting the certificate in the wrong store, then assuming Burp is broken.
- Forgetting to regenerate and re-trust the CA after reinstalling Burp — the old certificate no longer matches.
- Leaving the certificate installed on a personal machine long after testing ends. Remove it when you’re done; a trusted MITM certificate sitting in your keychain is a genuine security risk.
Set Target Scope Before You Browse
Scope is the difference between a tidy proxy history and an unreadable mess. Open the Target > Scope settings and add the domains you’re authorised to test. Burp will then grey out out-of-scope traffic, exclude it from the site map, and stop the scanner from wandering into third-party services.
Pair scope with a proxy history filter that hides out-of-scope items and static assets. Images, fonts, and analytics beacons dominate raw history and bury the requests that matter. Filtering on MIME type and scope takes thirty seconds and pays for itself within the first hour of testing.
Anyone moving from console emulation projects to web testing often hits the same lesson: tooling only helps when it’s configured to show you the signal. The same discipline that makes a clean emulator setup worthwhile, as covered in this guide to setting up PPSSPP, applies here — defaults are a starting point, not a finished configuration.
Add Extensions From the BApp Store
The BApp Store inside Burp installs community and PortSwigger-authored extensions with one click. A sensible starter set for most testers includes:
- Param Miner for discovering hidden parameters.
- Autorize for spotting broken access control.
- Logger for a searchable, persistent request log.
- Turbo Intruder for high-speed request floods when the built-in Intruder is too slow.
Extensions run with full access to your traffic and your machine, so treat the BApp Store as a curated list rather than a guarantee. Read what an extension does before installing it, and prune anything you’re not actively using. A bloated extension list slows startup and increases the chance of version conflicts after a Burp update.
Test the Setup Before Trusting It
Before pointing Burp at anything real, run a five-minute sanity check:
- Confirm the proxy listener is active and the browser routes through it.
- Load an HTTPS site and verify the certificate chain shows Burp’s CA, not a warning.
- Check that in-scope hosts appear in the site map and out-of-scope hosts are greyed.
- Send a request to Repeater and confirm the response comes back intact.
- If you’re testing a mobile app, repeat the certificate step on the device.
If HTTPS fails, the certificate is almost always the culprit. If nothing appears at all, the browser isn’t using the proxy. If some requests appear and others don’t, check for certificate pinning in the client — a pinned app rejects Burp’s certificate by design, and bypassing that requires instrumentation rather than configuration.
Keep Burp Updated and Your Config Portable
Burp ships updates frequently, and each release can change UI paths, Java requirements, or extension compatibility. Before an engagement, check the Professional edition page and the release notes for what changed, then update deliberately rather than mid-assessment. Export your configuration after any meaningful change so a reinstall takes minutes instead of an afternoon.
Portability matters more than people expect. Testers who work across a laptop, a VM, and a client-provided machine should keep the installer, the saved config, and a note of the Java version in one folder. Rebuilding a proxy setup from memory under time pressure is exactly when certificate mistakes happen.
The broader lesson from any tooling setup — whether it’s a proxy, an emulator, or a device configuration — is that the defaults rarely match your workflow. The same pattern shows up in consumer tech, where a Black Friday car deals roundup is only useful if it filters for the trim and budget you actually have. Configuration is the work.
Conclusion
A reliable Burp Suite setup in 2026 comes down to five decisions made in the right order: pick the edition that matches your work, confirm a compatible Java runtime, install from PortSwigger’s official releases, trust the CA certificate in the correct store, and lock down scope before you browse. Get those right and the tool disappears into the background, which is exactly what you want. Get them wrong and you’ll spend the session debugging certificates instead of testing. Build the baseline config once, export it, and every future engagement starts from a known-good state.
Frequently Asked Questions
Why does Burp Suite show certificate errors on HTTPS sites?
The browser doesn’t trust Burp’s CA certificate. Browse to ` through the proxy, download the certificate, and import it into the correct trust store — Firefox uses its own store, separate from the system one. Restart the browser afterwards.
Do I need Java installed to run Burp Suite?
Yes. Burp is a Java application and requires a compatible runtime. The minimum version changes between releases, so check the current requirement on PortSwigger’s download page rather than relying on older tutorials.
What is the difference between Community and Professional editions?
Community is free and supports manual testing with throttled Intruder and no automated scanner. Professional adds the scanner, faster Intruder, and full extension support. Enterprise targets teams running scheduled scans in CI/CD pipelines.
Why does no traffic appear in Burp when I browse?
Either the browser isn’t configured to use the proxy at `127.0.0.1:8080`, or the listener isn’t running. Burp’s embedded Chromium browser is preconfigured, so testing there isolates whether the problem is the listener or the external browser.
Can I intercept traffic from a phone or another device?
Yes, by adding a proxy listener bound to your LAN address and installing the CA certificate on the device. Keep the listener restricted to a trusted network, and expect some mobile apps to reject the certificate due to pinning.
Should I remove the Burp CA certificate after testing?
Yes. A trusted interception certificate left installed is a real security risk, because anything holding the matching private key could read that device’s encrypted traffic. Remove it from the trust store once the assessment ends.
