Skip to content
Get Started
G2G2
4.7/5
Excellent
Trustpilot

How to use a proxy with Burp Suite

In Burp Suite, open Settings → Network → Connections → Upstream proxy servers, click Add, set Destination host to *, enter your CleanProxies host and port, choose Basic authentication and enter your username and password. Burp then sends its outgoing traffic through CleanProxies, while your browser keeps using Burp's own listener on port 8080.

Try Now for $4.99Continue with Google
  • Session Control
  • High Speed
  • Privacy First

What you need

In Burp, "proxy" usually means its intercepting listener. This guide is about the next hop: an upstream proxy that makes Burp's traffic to the target leave from a US IP. That is useful for authorised tests of your own apps, such as checking geo-restricted features, IP allowlists and rate limits as an outside US user sees them.

Your credential line

From the dashboard's proxy manager: host (or IP), port, username and password. Convert lists with the proxy list formatter.

Burp Suite ready

  • Burp Suite Community or Professional (desktop).
  • Permission to test the target: your own application or an authorised engagement.

Which proxy fits Burp Suite?

Both products use the same setup in Burp Suite. What changes is how long an IP stays with you.

Static ISP Proxies

Best fit

Recommended. A 100% dedicated US ISP IP stays the same all month, so you can add it to the app's allowlist or WAF exception for the test window. SOCKS5 is available if you switch it on for the list.

starting from$0.75/IP

Dedicated static IPs registered to US and Canadian ISPs. The address stays the same for as long as you hold it, with unlimited bandwidth and HTTP(S) or SOCKS5 access.

Buy NowSee Static ISP Proxies features

Rotating Residential Proxies

Also works

Use a sticky line (5 minutes to 24 hours) so a logged-in test session keeps one IP; a rotating line changes the exit IP between connections, which breaks session-bound tests. Configure it as an upstream proxy rule with Basic auth.

starting from$0.63/GB

Residential IPs in 190+ countries with country, state and city targeting. Rotate on every request or hold a sticky session for up to 90 minutes; GB never expire.

Buy NowSee Rotating Residential Proxies features
credentials

Your CleanProxies credentials

Every product connects over HTTP(S); static ISP and ISP subnet proxies also run SOCKS5 and IP whitelisting. This is what the dashboard gives you to paste into Burp Suite.

Static ISP and ISP subnetHTTP(S)SOCKS5IP whitelist
IP:PORT:USER:PASS

One line per dedicated IP. With IP whitelisting on, the line is just IP:PORT and no password is sent.

Rotating residential and mobileHTTP(S)User:pass
HOST:PORT:USER:PASS

Generated in the proxy manager. The username carries the location and session you pick, so generate a new list to change them.

As a URL, for code and most toolshttp://USERNAME:PASSWORD@HOST:PORTsocks5://USERNAME:PASSWORD@HOST:PORT

Use http:// even for HTTPS websites; the TLS session still runs end to end. The socks5:// form is for static ISP and ISP subnet proxies.

How to set up CleanProxies in Burp Suite

Four steps, then check the exit IP with the free proxy checker.

  1. 1

    Open the Connections settings

    Open Settings, then Network → Connections. Tick Override options for this project only if the proxy should apply to this project alone.

  2. 2

    Add an upstream proxy rule

    Under Upstream proxy servers, click Add to open the Add upstream proxy rule dialog.

  3. 3

    Fill in the rule

    Destination host *, Proxy host HOST, Proxy port PORT, Authentication type Basic, then your username and password. Click OK.

  4. 4

    Send a test request

    In Repeater, send a request to api.ipify.org (see Verify). The response body is the IP the target sees.

settings

Burp Suite proxy settings

Replace the highlighted placeholders with the values from your dashboard. Pick an example to see its code.

Burp Suite + CleanProxies

Upstream rules with wildcards

Burp checks the rules from the top and uses the first one whose destination host matches; hosts that match no rule connect directly. A rule with a blank proxy host also connects directly, which is how you keep some hosts off the proxy.

Upstream proxy servers (top to bottom)Text
Destination host        Proxy host   Proxy port   Auth type
*.internal.example.com  (blank)                   
app.example.com         HOST         PORT         Basic
*                       HOST         PORT         Basic
  • * matches any characters and ? matches one character other than a dot. Use the move up and move down buttons beside the list to reorder rules.

Listener vs upstream proxy

  • The proxy listener is Burp's local HTTP proxy (by default port 8080 on the loopback interface). Your browser connects to it so Burp can intercept traffic.
  • The upstream proxy is where Burp sends that traffic next. The chain is browser → Burp listener → CleanProxies → target.
  • So CleanProxies goes into Burp's Connections settings, never into the browser's proxy settings, which must keep pointing at the listener.

SOCKS5 on ISP proxies

Switch SOCKS5 on for the ISP proxy list in the CleanProxies dashboard (same username and password). In Burp's Connections settings, enable Use SOCKS proxy, open Configure, enter the host, port, username and password, and tick Do DNS lookups over SOCKS proxy so hostnames resolve on the proxy side.

Rotating residential and mobile proxies are HTTP(S) only, so use them through an upstream proxy rule.

fix it fast

Troubleshooting Burp Suite proxy errors

Verify your exit IP

In Repeater, set the target to api.ipify.org, port 443 with HTTPS, and send the request below. The response body is the exit IP; it should match your CleanProxies line, not your own connection.

Open What is my IP? through the proxy to see the address and headers a website receives, or paste up to ten lines into the free proxy checker to test connectivity, latency and exit IP.

Still stuck? Our 24/7 support team answers fast: contact us with the error and the line you used (leave the password out).

Burp Suite error fixes
  • 407 Proxy Authentication RequiredWhy: Authentication type set to NTLM, or a typo in the username or password.Edit the rule, choose Basic and enter the credentials again from the dashboard.
  • Requests still leave from your own IPWhy: No rule matches the target, or a rule above it has a blank proxy host.Keep a * rule at the bottom of the list and move specific rules above it.
  • The browser stops loading pagesWhy: CleanProxies was entered in the browser's proxy settings, replacing Burp's listener.Point the browser back at the listener (or use Burp's built-in browser) and put CleanProxies only in the upstream rule.
  • Internal hosts don't resolve with SOCKS5Why: Do DNS lookups over SOCKS proxy sends every lookup to the proxy, which can't see your private DNS.Add internal hosts to the SOCKS exclusion list under the SOCKS proxy settings.
  • The proxy works in one project but not anotherWhy: One project overrides the user-level Connections settings.Check Override options for this project only in each project's settings.

Burp Suite proxy guides

Setup guides and best practices from the CleanProxies blog.

Get the latest insightsAll Blogs

More integrations

Setup guides for tools people run next to Burp Suite.

All integrations

Burp Suite proxy FAQs

Straight answers about running CleanProxies in Burp Suite.

The Burp proxy is a local listener your browser connects to so Burp can intercept traffic. An upstream proxy is the next hop Burp uses to reach the target, which decides the IP address the target sees.

Got more questions?All FAQs