Proxy intercept

From the Proxy > Intercept tab, you can intercept HTTP requests and responses sent between the browser and the target server. This enables you to study how the website behaves when you interact with it.

The intercept feature enables you to perform the following useful actions:

• Intercept a request and modify it before forwarding it to the server.
• Send interesting requests to Burp's other tools, such as Repeater or Intruder, for further testing.
• Drop a request to prevent it from reaching the server.

Controls

When you intercept a message, the request details are populated in the Proxy > Intercept tab. You can see details of the target server at the top of the panel. For HTTP requests you can manually edit the target server. Select the Edit target menu .

The panel also contains the following controls:

• Forward - After you review or edit the message, click Forward to send the message to the target.
• Drop - To cancel the request so that it never reaches the target server, click Drop.

• Interception is on/off - Use this button to toggle all interception on and off:

  • If the button shows Intercept is on, messages are intercepted. You can also configure messages to be forwarded automatically using the settings for interception of HTTP and WebSocket messages.
  • If the button shows Intercept is off, Burp forwards all messages automatically.
• Action - This shows the context menu for the main panel. From here, you can perform a range of actions such as running scans, or sending requests to other Burp tools.

• Comment field - You can add a comment to interesting items to easily identify them later. Any comments you make also appear against the item in the HTTP history.

  • If you add a comment to an HTTP request, the comment appears again if the corresponding response is also intercepted.
• Highlight - You can apply a colored highlight to interesting items. Highlights behave the same as comments, they appear in the Proxy history and on intercepted responses.

Message display

The message editor in the main panel shows the current intercepted message. From here you can analyze the message and perform actions on it.

Click Action to see the context menu and access the standard functions. You can also perform the following actions for HTTP messages:

• Don't intercept requests/responses - You can add an interception rule so that Burp automatically forwards messages that share a specific feature, such as host, file extension, or HTTP status code. Use this feature if you're seeing a lot of uninteresting requests or responses of a particular type.
• Do intercept - Select this function to intercept the response to the currently displayed request. This is only available for requests.

Protocol

You can use the Inspector to edit the protocol for the request. For more information, see the HTTP/2 documentation.