=== Burp Proxy

Another proxy you can use is Burp. One of the exercises in WebGoat can only be resolved with Burp and not yet with OWAP ZAP.
You can only configure Burp manually. Please follow the steps described link:start.mvc#lesson/HttpProxies.lesson/8[here] first.
You can download the Burp community edition as a https://portswigger.net/burp/communitydownload[plain jar file,window=_blank]

[source]
----
java -jar burpsuite_community_v2.1.04.jar
----

Choose `temporary project`, followed by `use burp defaults.`

Go to the proxy options and change it to use port 8090

image::images/burpproxy.png[Burp proxy options,style="lesson-image"]

On this page, you can also export the Burp certificate and import it into your browser. Similar to the instructions in previous pages.

Go to the proxy intercept page and click on the toggle so that intercept is switched off. (By default nd in the picture below, it is switched on)

image::images/burpintercept.png[Burp intercept,style="lesson-image"]

Then start a browser connected to the proxy and start using WebGoat.
Now adjust the intercept request setting by extending the rule on what not to intercept:

image::images/burpfilterclient.png[Burp client request filter,style="lesson-image"]

Use e.g.: (\^mvc$|^txt$|\^woff$|^lesson$|\^gif$|^jpg$|\^png$|^css$|\^js$|^ico$)
Then enable the intercept by clicking on the earlier mentioned toggle.

An intercept will look like:

image::images/burpintercepted.png[Burp client request filter,style="lesson-image"]

Finally, you can look at the history and add filters for the history and replay requests from this screen:

image::images/burpfilter.png[Burp history,style="lesson-image"]
