Http Messages and controlled testing need different evidence
Burp Suite is most educational when students understand the HTTP message being changed. Reports should capture the original request, the controlled test, the server response and the application rule that should have prevented the behaviour.
- Proxying and understanding request structure
- Repeater for controlled comparison