Using Burp Suite with Firefox

Burp Suite’s built-in browser (Chromium-based) has proxy and SSL interception pre-configured, and is the recommended option — it keeps assessment traffic isolated from personal browsing. However, the built-in browser is compiled as x86_64 on Linux, so it doesn’t work on ARM platforms (Raspberry Pi, Apple Silicon VMs). Firefox is the standard fallback.

Firefox configuration

1. Proxy: Settings > General > Network Settings > Manual proxy configuration → HTTP Proxy 127.0.0.1, Port 8080, check “Also use this proxy for HTTPS”
2. Passwords: Disable “Ask to save logins and passwords” (prevents credential leakage into the assessment profile)
3. History: Enable “Always use private browsing mode” (no persistent cookies/cache between sessions)

Install the Burp CA certificate

Without the CA certificate, Firefox will block HTTPS connections through Burp:

1. Start Burp Suite
2. Browse to http://127.0.0.1:8080 in Firefox
3. Click “CA Certificate” to download cacert.der
4. Go to Settings > Privacy & Security > Certificates > View Certificates > Import
5. Select the downloaded certificate and check “Trust this CA to identify websites”

FoxyProxy alternative

FoxyProxy allows toggling Burp’s proxy on/off per-tab without changing global Firefox settings. The Burp CA certificate must still be installed as above. The tradeoff is convenience vs. separation — with FoxyProxy it’s easier to accidentally mix assessment and personal traffic in the same browser profile.

For CTFs and single-target assessments, FoxyProxy’s pattern-based proxying is the sweet spot: add a pattern for the target IP (e.g. 10.10.158.139) and set FoxyProxy to “Use proxies based on their pre-defined patterns and priorities”. Only matching traffic is routed through Burp; everything else goes direct. This keeps the browser usable for research while still intercepting the target application.

Sources

• Configuring Firefox to work with Burp Suite — PortSwigger
• Installing Burp’s CA certificate in Firefox — PortSwigger

Related: burp-suite, owasp-zap, burp-suite-aws-cli-proxy, burp-suite-mobile-apps, xss-attacks