Burpsuite

Burp Suite

Web application security testing platform.

Quick Start

burpsuite
# Set browser proxy: 127.0.0.1:8080
# Install CA cert: browse to http://burp → CA Certificate (or Proxy → Options → Import/Export CA)
# Firefox: FoxyProxy extension for quick toggle

Core Tools

Shortcuts

Proxy: Key Settings

Proxy → Options:
- Intercept Client Requests: check "URL is in target scope"
- Match and Replace: inject headers, modify values without intercepting every request

Proxy → HTTP History:
- Filter: show only in-scope, exclude images/CSS/JS
- Ctrl+F: search across all history (regex supported)
- Right-click → Add to scope / Send to Intruder/Repeater/Scanner

Match and Replace rules

# Proxy → Options → Match and Replace
# Add rule:
Type: Request header
Match: ^
Replace: X-Forwarded-For: 127.0.0.1

# Type: Response body
# Match: You must be logged in
# Replace: Welcome admin
# (useful for bypassing client-side auth checks)

# Type: Request header, Replace: Authorization: Bearer <stolen_token>
# Auto-injects auth on every request

Scope Configuration

Target → Scope → Include in scope:
Protocol: https
Host: ^target\.com$  # regex supported
Path: ^/api/

# "Use Advanced Scope Control" for regex rules
# Project → Options → Out-of-scope URLs: Drop → avoids noise

Intruder Attack Types

# Brute-force login:
POST /login → Intruder → Cluster Bomb
§username§ → payload list: users.txt
§password§ → payload list: passwords.txt

# Grep Match: "Invalid credentials" → failed
# Grep Match: "Welcome" → success
# Sort by length to find successful responses

Repeater Workflows

# Manual SQLi test:
GET /item?id=1 → Repeater
Modify: id=1'       → check for error
        id=1 AND 1=1 → check for normal response
        id=1 AND 1=2 → check for different response

# IDOR test:
GET /api/user/123 → Repeater
Change 123 → 124, 125 (other users)
Check response for data leakage

# HTTP Request Smuggling (Pro/manual):
Change Connection: keep-alive
Add Transfer-Encoding: chunked
Craft ambiguous body

Common Workflows

Auth bypass (parameter tampering)

1. Intercept login request
2. Observe response → session cookie/token
3. Forward → capture admin endpoint request
4. Replay with modified role/flag parameters

Session token analysis

Sequencer → Token Location: Cookie/Header
Start Live Capture → 10,000+ samples
Analyze → check entropy (should be >100 bits effective entropy)

Active Scanner (Pro)

# Right-click target in Proxy History → Scan
# Or: Dashboard → New Scan → URL → select scan type
# Audit checks: SQL injection, XSS, XXE, SSRF, path traversal, etc.

# Scan configuration:
# Built-in: "Audit coverage - maximum" vs "Audit checks - critical issues only"
# Custom: reduce noise, set concurrency, timeout

Bambda (Java lambda filters, Burp 2023+)

// Filter History to show only 4xx with JSON body:
return requestResponse.response().statusCode() >= 400
    && requestResponse.response().statusCode() < 500
    && requestResponse.response().hasHeader("Content-Type", "application/json");

// Find requests with Authorization header:
return requestResponse.request().hasHeader("Authorization");

// Find responses containing "password" (case-insensitive):
return requestResponse.response().bodyToString().toLowerCase().contains("password");

Extensions (BApp Store)

# Install: Extender → BApp Store

Turbo Intruder example

# High-speed race condition test:
def queueRequests(target, wordlists):
    engine = RequestEngine(endpoint=target.endpoint,
                           concurrentConnections=30,
                           requestsPerConnection=100,
                           pipeline=True)
    for i in range(30):
        engine.queue(target.req, str(i))

def handleResponse(req, interesting):
    if '200' in req.status:
        table.add(req)

Resources