Burp Suite Simulator

Intercept and edit real-looking HTTP requests against a mock vulnerable web app - hunt for SQL injection, IDOR, XSS and path traversal in a fully offline sandbox. Save your findings as a shareable report.

Ideal for: Aspiring web app pentesters and bug bounty beginners learning to read and manipulate raw HTTP requests before touching a real target.

What you'll practice

Capture requests from a mock target app in a Proxy history view
Edit raw HTTP requests in a Repeater-style pane and resend them
Confirm SQL injection, IDOR, reflected XSS and path traversal findings
Save your request log and confirmed findings as a shareable report

Start practicing

Burp Suite Simulator is part of Practice Tools. Sign in or create an account, then subscribe for ₦4,000/month to unlock it.

📋 Lab Instructions

Step-by-step exercises for Burp Suite Simulator - read them here, then practice live in the tool above.

Getting Started with the Burp Suite Simulator

Last updated: August 8, 2026

What you're practicing: intercepting and manipulating HTTP requests to find real web-app vulnerabilities. 1. Click "Open" to launch the simulator. 2. On the Proxy tab, click "Log in (valid creds)" to capture your first request -- it appears in History and loads into the editor. 3. Try the other quick actions (Search, View Profile, Download Invoice) to capture a few more requests. 4. Pick the login request, edit the username field to something like admin' OR '1'='1, then click Send -- read the response. 5. Pick the profile request, change the id parameter to a different number than your own, and Send -- see what comes back. 6. Pick the search request, put a script-tag payload in the q parameter, and Send. 7. Pick the download request, change the file parameter to a path-traversal style value, and Send. 8. Check the Findings tab -- each successful test should have added a confirmed vulnerability with an explanation. 9. Click Save This Session as a Project to keep your request log and findings. Tip: in Burp, the Repeater tab is for iterating on ONE request -- send it, tweak one parameter, send again, and compare responses side by side.