How to Use Burp Suite for LLM Security Testing | Day17

📰 Originally published on Securityelites — AI Red Team Education — the canonical, fully-updated version of this article.

🤖 AI/LLM HACKING COURSE

FREE

Part of the AI/LLM Hacking Course — 90 Days

Day 17 of 90 · 18.8% complete

⚠️ Authorised Targets Only: All Burp Suite interception and manipulation must only be performed against systems within your authorised scope. Routing your own API credentials through Burp to test your own application or authorised targets is fine. Never intercept traffic to AI services using credentials or accounts belonging to other parties.

The first time I used Burp Suite to intercept an AI API request, I spent about thirty seconds just staring at the raw JSON body. There it was: the system prompt, sitting in plaintext in the request the application was sending to OpenAI. The entire instruction set. The database name. The internal API references. The confidentiality instruction that said “do not reveal this to users” — which was, at that moment, being revealed to anyone with a proxy in their traffic path.

That wasn’t a model vulnerability. It wasn’t a prompt injection finding. It was a clean information disclosure at the transport layer — the kind of thing that gets caught immediately when you’re looking at raw HTTP but never when you’re testing through a browser UI. Burp sits at the right layer for AI testing. Not above it (browser UI), not below it (model weights) — exactly at the HTTP layer where requests are formed and responses are processed. Day 17(Burp Suite for LLM Security Testing) builds the complete Burp workflow for AI security testing: proxy setup for AI APIs, Repeater for manipulation, Intruder for payload scanning, and the evidence capture flow that makes every finding reportable.

🎯 What You’ll Master in Day 17

Configure Burp to intercept HTTPS traffic to OpenAI, Anthropic, and custom AI API endpoints
Route Python AI scripts through Burp proxy using the httpx client override
Manipulate system prompts and user messages directly in Burp Repeater
Run prompt injection payload libraries through Burp Intruder with grep match filtering
Use Burp Comparer to diff baseline vs injected responses
Export clean HTTP request/response pairs as primary technical evidence

⏱️ Day 17 · 3 exercises · Kali Terminal + Burp Suite + Think Like Hacker ### ✅ Prerequisites - Burp Suite Deep Dive — proxy setup, Repeater, and Intruder basics — Day 17 assumes fluency with these before applying them to AI traffic - Day 16 — Automated Injection Testing — the payload library from Day 16 loads directly into Burp Intruder in Day 17 - Burp Suite Professional or Community installed on Kali — Community works for all exercises except Intruder speed ### 📋 Burp Suite for LLM Security Testing — Day 17 Contents 1. Proxy Setup for AI API Endpoints 2. AI API Request Anatomy in Burp 3. Repeater Workflow for Prompt Manipulation 4. Intruder Payload Scanning for Injection 5. Routing Python Scripts Through Burp 6. Evidence Export and Report Integration In Day 16 you built the automated scanner that covers breadth. Day 17 builds the manual investigation layer that Burp provides — the ability to look at individual requests in detail, modify them precisely, and capture evidence in the format that professional reports require. Day 18 applies the full Burp workflow to system prompt extraction — using what you build today as the primary interception tool for the 15-technique extraction methodology.

Proxy Setup for AI API Endpoints

Setting up Burp to intercept AI API traffic is the same process as any HTTPS interception — Burp CA certificate installed, traffic routed through localhost:8080 — with one additional consideration. AI APIs use certificate pinning at the SDK level in some configurations. The standard Burp CA installation handles browser-based AI applications fine. For SDK-based calls (your Python scripts, custom integrations), you need to either disable certificate verification explicitly or configure the HTTP client to trust Burp’s CA.

The OpenAI Python SDK uses httpx as its HTTP client. Passing a custom httpx.Client to the OpenAI constructor with proxy settings and verify=False is the cleanest approach — it routes all SDK calls through Burp without affecting system-level certificate verification. Only use verify=False in your test environment and never in production code. Once you’ve seen what you need to see, remove it.

BURP PROXY SETUP FOR OPENAI AND ANTHROPIC APISCopy

Method 1: Environment variable (affects all HTTP clients)

export HTTPS_PROXY=”http://127.0.0.1:8080″
export HTTP_PROXY=”http://127.0.0.1:8080″
export REQUESTS_CA_BUNDLE=”/path/to/burp-ca.pem” # or unset SSL verify

Method 2: Per-client httpx override (cleaner for testing)

import httpx
from openai import OpenAI

burp_client = httpx.Client(
proxy=”http://127.0.0.1:8080″,
verify=False # only for test environments
)
client = OpenAI(
api_key=os.getenv(“OPENAI_API_KEY”),
http_client=burp_client
)

All client.chat.completions.create() calls now route through Burp

Anthropic SDK equivalent

import anthropic
ant_client = anthropic.Anthropic(
api_key=os.getenv(“ANTHROPIC_API_KEY”),
http_client=httpx.Client(proxy=”http://127.0.0.1:8080″, verify=False)
)

Burp: Proxy → Options → Add listener on 8080

Import CA: Proxy → Options → CA Certificate → Export → Import in browser

⚡ EXERCISE 1 — KALI TERMINAL (20 MIN)
Route Your Day 16 Scanner Through Burp and Capture the AI API Request

---

📖 Read the complete guide on Securityelites — AI Red Team Education

This article continues with deeper technical detail, screenshots, code samples, and an interactive lab walk-through. Read the full article on Securityelites — AI Red Team Education →

---

This article was originally written and published by the Securityelites — AI Red Team Education team. For more cybersecurity tutorials, ethical hacking guides, and CTF walk-throughs, visit Securityelites — AI Red Team Education.