Burpsuite

Burp Suite

Web application security testing platform.

Quick Start

burpsuite
# Set browser proxy: 127.0.0.1:8080
# Install CA cert: browse to http://burp → CA Certificate (or Proxy → Options → Import/Export CA)
# Firefox: FoxyProxy extension for quick toggle

Core Tools

Shortcuts

Proxy: Key Settings

Proxy → Options:
- Intercept Client Requests: check "URL is in target scope"
- Match and Replace: inject headers, modify values without intercepting every request

Proxy → HTTP History:
- Filter: show only in-scope, exclude images/CSS/JS
- Ctrl+F: search across all history (regex supported)
- Right-click → Add to scope / Send to Intruder/Repeater/Scanner

Match and Replace rules

# Proxy → Options → Match and Replace
# Add rule:
Type: Request header
Match: ^
Replace: X-Forwarded-For: 127.0.0.1

# Type: Response body
# Match: You must be logged in
# Replace: Welcome admin
# (useful for bypassing client-side auth checks)

# Type: Request header, Replace: Authorization: Bearer <stolen_token>
# Auto-injects auth on every request

Scope Configuration

Target → Scope → Include in scope:
Protocol: https
Host: ^target\.com$  # regex supported
Path: ^/api/

# "Use Advanced Scope Control" for regex rules
# Project → Options → Out-of-scope URLs: Drop → avoids noise

Intruder Attack Types

# Brute-force login:
POST /login → Intruder → Cluster Bomb
§username§ → payload list: users.txt
§password§ → payload list: passwords.txt

# Grep Match: "Invalid credentials" → failed
# Grep Match: "Welcome" → success
# Sort by length to find successful responses

Repeater Workflows

# Manual SQLi test:
GET /item?id=1 → Repeater
Modify: id=1'       → check for error
        id=1 AND 1=1 → check for normal response
        id=1 AND 1=2 → check for different response

# IDOR test:
GET /api/user/123 → Repeater
Change 123 → 124, 125 (other users)
Check response for data leakage

# HTTP Request Smuggling (Pro/manual):
Change Connection: keep-alive
Add Transfer-Encoding: chunked
Craft ambiguous body

Common Workflows

Auth bypass (parameter tampering)

1. Intercept login request 2. Observe response → session cookie/token 3. Forward → capture admin endpoint request 4. Replay with modified role/flag parameters

Session token analysis

Sequencer → Token Location: Cookie/Header
Start Live Capture → 10,000+ samples
Analyze → check entropy (should be >100 bits effective entropy)

Active Scanner (Pro)

# Right-click target in Proxy History → Scan
# Or: Dashboard → New Scan → URL → select scan type
# Audit checks: SQL injection, XSS, XXE, SSRF, path traversal, etc.

# Scan configuration:
# Built-in: "Audit coverage - maximum" vs "Audit checks - critical issues only"
# Custom: reduce noise, set concurrency, timeout

Bambda (Java lambda filters, Burp 2023+)

// Filter History to show only 4xx with JSON body:
return requestResponse.response().statusCode() >= 400
    && requestResponse.response().statusCode() < 500
    && requestResponse.response().hasHeader("Content-Type", "application/json");

// Find requests with Authorization header:
return requestResponse.request().hasHeader("Authorization");

// Find responses containing "password" (case-insensitive):
return requestResponse.response().bodyToString().toLowerCase().contains("password");

Extensions (BApp Store)

# Install: Extender → BApp Store

Turbo Intruder example

# High-speed race condition test:
def queueRequests(target, wordlists):
    engine = RequestEngine(endpoint=target.endpoint,
                           concurrentConnections=30,
                           requestsPerConnection=100,
                           pipeline=True)
    for i in range(30):
        engine.queue(target.req, str(i))

def handleResponse(req, interesting):
    if '200' in req.status:
        table.add(req)

Resources

Burp Suite — BApp Extensions for Offensive Testing

Essential Extensions

Autorize — Broken Access Control Detection

Automatically retest every request with lower-privilege session to detect IDOR and auth bypass.

Setup:
1. Install Autorize from BApp Store
2. Log in as high-privilege user, copy session cookie
3. Autorize tab → paste low-privilege cookie in "Authorization Header"
4. Enable Autorize (toggle on)
5. Browse application as high-privilege user
6. Autorize replays each request with low-priv cookie
7. Red = bypassed (low-priv got same response as high-priv) → IDOR/BAC finding
8. Filter: show "Bypassed!" only

JWT Editor — JWT Manipulation

Attacks available:
- Algorithm confusion (RS256 → HS256): use public key as HMAC secret
- None algorithm: remove signature entirely
- Embedded JWK: inject attacker-controlled key in header
- JWKS spoofing: point jku/x5u to attacker-controlled URL

Workflow:
1. Intercept request with JWT → Repeater
2. JWT Editor tab in request → modify claims (e.g., "role": "admin")
3. Sign with embedded key or attack signature
4. Resend and observe response

# alg:none attack (manual):
# Decode JWT, change {"alg":"RS256"} → {"alg":"none"}
# Remove signature (keep trailing dot)
# eyJhbGciOiJub25lIn0.eyJzdWIiOiJhZG1pbiJ9.

Param Miner — Hidden Parameter Discovery

# Right-click request → Extensions → Param Miner → Guess params
# Options:
# - Guess headers: finds non-standard headers (X-Forwarded-For, X-Original-URL, etc.)
# - Guess params: finds hidden GET/POST params that affect response
# - Guess cookie params: additional cookie parameters

# Useful for:
# - Finding X-Forwarded-Host → Host header injection
# - Finding hidden debug params (debug=true, admin=1)
# - Cache poisoning vectors

Active Scan++ — Extended Checks

Adds checks not in default scanner:
- SSRF via Collaborator probes in all params
- XXE in XML bodies
- Template injection (SSTI)
- Code injection patterns
- HTTP header injection
- Prototype pollution

Install: BApp Store → Active Scan++
# Automatically runs on scanned requests

Turbo Intruder — High-Speed Fuzzing

# Race condition test (simultaneous requests):
def queueRequests(target, wordlists):
    engine = RequestEngine(endpoint=target.endpoint,
                           concurrentConnections=30,
                           requestsPerConnection=100,
                           pipeline=True)
    for i in range(30):
        engine.queue(target.req, str(i))

def handleResponse(req, interesting):
    if '200' in req.status:
        table.add(req)

# Password spray (fast):
def queueRequests(target, wordlists):
    engine = RequestEngine(endpoint=target.endpoint,
                           concurrentConnections=5,
                           requestsPerConnection=1)
    for word in open('/usr/share/wordlists/rockyou.txt'):
        engine.queue(target.req, word.rstrip())

def handleResponse(req, interesting):
    if 'Invalid' not in req.response:
        table.add(req)

Other Useful Extensions

BApp Installation

Extender → BApp Store → search → Install
# Or manual: Extender → Extensions → Add → select JAR/Python/Ruby file
# Python extensions require Jython standalone JAR configured in Extender → Options

Collaborator (OAST) Setup

# Burp Collaborator = out-of-band interaction server
# Use for blind SSRF, blind XXE, blind XSS, DNS exfiltration

# Pro: use built-in Collaborator
Project → Options → Misc → Burp Collaborator Server
# Or set up private: burp collaborator --collaborator-config=config.json

# In Repeater: right-click → Insert Collaborator Payload
# Generates: xxxxx.burpcollaborator.net
# Use in: SSRF target, XXE DTD, img src, email field, etc.

# Check interactions:
Burp menu → Burp Collaborator Client → Poll now

Burp Suite — Intruder Patterns & Repeater Workflows

Intruder: Attack Configuration

Payload Position Markers

# Mark positions with § in request body:
username=§admin§&password=§password§

# Sniper: one position at a time
# Cluster Bomb: all combos (u×p requests)
# Pitchfork: parallel lists (same index)

Payload Types

Payload Processing Rules

# Transform payloads before sending:
# Add prefix: admin_
# Add suffix: @target.com
# URL encode
# Base64 encode
# Hash (MD5/SHA1/SHA256)
# Match/replace regex

# Example: brute-force with MD5-hashed passwords
# Rule chain: Hash (MD5) → URL encode

Grep Rules for Response Analysis

# Grep Match: find specific strings in responses
# "Invalid password" → failed logins
# "Welcome back" → successful login
# "Access denied" → auth check
# "error in your SQL" → SQLi indicator

# Grep Extract: pull values from responses
# Regex: token="([^"]+)"  → extract CSRF tokens, session IDs

# Intruder → Grep - Match → add patterns
# Results column: boolean (found/not found)
# Sort by column to find outliers

Common Intruder Workflows

IDOR / Horizontal Privilege Escalation

# Enumerate object IDs:
GET /api/document/§1§ HTTP/1.1

# Attack type: Sniper
# Payload: Numbers 1-1000
# Grep: your own data (baseline)
# Look for: same/longer response length when ID changed
# Check: grep for other users' data

Password Brute-Force (Login)

POST /login HTTP/1.1
username=admin&password=§password§

# Attack: Sniper
# Payload: /usr/share/wordlists/rockyou.txt
# Grep Match: "Invalid" (failed indicator)
# Filter: where match not found = success

# Cluster Bomb for unknown username:
username=§user§&password=§pass§
# Payload 1: users.txt
# Payload 2: 100 common passwords

CSRF Token Extraction and Reuse

# Get fresh CSRF token per request:
# Intruder → Options → Extract grep
# Regex: csrf_token" value="([^"]+)"
# Use extracted value as payload in next request
# (Recursive grep — requires Macros for full automation)

OTP / 2FA Brute-Force

POST /verify HTTP/1.1
code=§1234§

# Attack: Sniper
# Payload: Numbers (0000-9999) with padding (4 digits)
# Rate limit: set request throttle or use Turbo Intruder for race

Session Handling Rules (Macros)

# For apps that require valid CSRF token or session per request:
Project → Options → Sessions → Session Handling Rules
→ Add rule → Run macro
→ Add macro: record the login/token-fetch request
→ Define what to extract (CSRF token, session cookie)
→ Apply to: Intruder / Scanner / Repeater

# Full flow:
1. Record: GET /login → extract csrf_token
2. Record: POST /login (with credentials) → extract session cookie
3. Add rule: run macro before each Intruder request
4. Intruder now has fresh session for each payload

Repeater: Advanced Usage

# HTTP/2 requests:
# Repeater → Inspector panel → Request Attributes → Protocol: HTTP/2
# Test for HTTP/2 downgrade attacks, header smuggling

# Request smuggling (TE.CL):
POST / HTTP/1.1
Host: target.com
Transfer-Encoding: chunked
Content-Length: 6

0

# WebSocket messages:
# Proxy → WebSockets History → Send to Repeater
# Modify and replay individual WS frames

# Comparison workflow:
# Two requests side-by-side: Window → New Window or use tabs
# Comparer: right-click → Send to Comparer

Scanner Configuration (Pro)

# Fine-tune active scanner:
Dashboard → New Scan → Scan Configuration → New

Audit optimization:
- Select issue types to check
- Set request engine: concurrency, delay, timeout
- "Minimize false positives" vs "Maximize coverage"

# Useful custom configs:
- "XSS only" — minimize noise, confirm injections
- "SQL injection only" — targeted injection test
- "Information disclosure" — check error pages, backups, etc.

# Scan from Proxy History:
- Select interesting requests
- Right-click → Scan