Learning with Burp AT

Burp AT can help you build your security testing skills as you work through Web Security Academy labs. Use it to discuss testing ideas, understand unexpected results, and review your evidence.

Use Burp AT with your lab

If you haven't used Burp AT before, see Getting Started with Burp AT for general setup help.

To use Burp AT with an Academy lab:

Go to Proxy > Intercept and click Open browser. Open your lab in Burp's browser so you can inspect its traffic in Burp.
In the same Burp project, click Burp AT in the top-right corner.
Tell Burp AT which lab you are working on and what you want help with. Optionally, include what you have tried and what you observed.

Burp AT can usually identify the lab URL from your Proxy traffic. You can also share the running lab instance URL from your browser tab, for example https://YOUR-LAB-ID.web-security-academy.net/.

If Burp AT needs to add the lab to scope, it asks for your approval. See autonomy modes and tool permissions to understand how to control its actions.

You can share relevant requests and responses to give Burp AT evidence from your tests. For instructions on sending these from Burp's tools, see Sharing Burp resources in the Burp AT documentation.

Get guidance from the Academy lab mentor skill

Burp AT's Academy lab mentor skill asks questions and offers small clues to help you work out your next step.

To use the skill, run /academy-lab-mentor. Describe what you have tried and where you need help. The skill uses your observations and lab traffic in Burp to tailor its questions and clues.

Note

The skill's instructions tell Burp AT to keep the solution private, but they do not guarantee spoiler protection. Skill instructions guide behavior but do not enforce tool restrictions.

For more information about using skills, see Skills.

Apply what you learn

After you complete a lab, the mentor skill asks three open questions, one at a time. These explore why the vulnerability was possible, what evidence demonstrates it, and how the application could prevent it.

Answer using observations from your own tests. Use the discussion to identify what you would look for when testing another application for the same vulnerability.

Examine Burp AT's approach

You can also ask Burp AT to attempt a lab, then examine its approach. In this case, Burp AT performs the testing work for you to review.

Inspect its requests and responses. Discuss why it chose a test and whether the results support its conclusions. Reproduce tests yourself to check your understanding.

See Reviewing findings for guidance on assessing Burp AT's evidence.