#Burp suite setup proxy how to

To disconnect Postman from Burp’s proxy listener, just go back to Postman’s proxy settings and uncheck the Add a custom proxy configuration box. You can now modify the request and send it through, or move it to Intruder or Repeater to play with it further. Once you are done, click the Send button.īurp Suite will intercept the request. Select one of the endpoints from you collection, set the values you want for the request headers and fill in the request body you want to include. In a real life scenario where you’re testing a production app that is likely using HTTPS, make sure you tick that proxy type also, otherwise HTTPS requests won’t be proxied. This is because I’m using the vAPI vulnerable app for this demonstration, that uses HTTP. Note that in the example above, I have ticked the HTTP proxy type only. In the Settings panel, go to Proxy, then tick the Add a custom proxy configuration box and enter the server and port values you noted in Burp Suite. Now go back to the Intercept sub-tab under the Proxy tab and turn intercept on.īack in Postman, click on the cog wheel icon at the top right of the interface and choose Settings. If you haven’t modified the default values, they should be similar to those in the screenshot above.Īlso make sure the Running box is checked. In the Proxy listeners box, you have the parameters to which Burp’s proxy listener is set. In the Proxy tab, select the Proxy Settings sub-tab. Check Burp Suite’s proxy settingsįirst make sure you have the right proxy settings. To move the full request into Burp Suite, taking along the method, URL, headers and body, you can use Postman’s proxy feature. Now what if you want to use one of these endpoints in Burp Suite? Each of these endpoints has an http method, a URL, a list of request headers and maybe a request body. Suppose you have a list of API endpoints stored in a collection in Postman.

#Burp suite setup proxy how to

Here is a quick and easy tip on how to get the two most useful API hacking tools to work together: Postman and Burp Suite.