Burp Suite Pro Tips for Bug Bounty
Advanced Techniques for Web Application Security Testing
Essential Burp Configuration
# Proxy Settings Proxy -> Options -> Proxy Listeners Add: 127.0.0.1:8080 Enable: Support invisible proxy # Match and Replace Add rules: User-Agent: Mozilla/5.0 (compatible; Bot) Header: X-Forwarded-For: 127.0.0.1 # Scope Configuration Target -> Scope -> Use advanced scope Include: https://target.com/.* Exclude: .*logout.* (avoid logout loops) # Scanner Configuration Scanner -> Options -> Active Scanning Insert Point Types: check all Server Timeout: 30 seconds Threads: 5 (reduce if unstable) # Session Handling Project Options -> Sessions Add Rule -> Check "Maintain sessions" Macro Recorder: capture login sequence
Intruder Attack Strategies
# SQL Injection Fuzzing
Position: param=§'§
Payload list: SQLMap payloads + custom
Attack Type: Sniper
Grep: Check for error patterns
# XSS Testing
Position: param=§<script>alert(1)</script>§
Payload: Various XSS vectors
Attack Type: Sniper
# IDOR Enumeration
Position: user_id=§123§
Payload: Sequential numbers 1-1000
Attack Type: Sniper
Filter: Response size differences
# Mass Parameter Fuzzing
Use "Grep - Extract" for parameter names
Attack Type: Cluster Bomb
Position 1: parameter names
Position 2: test values
# Race Condition Testing (Turbo Intruder)
import time
def queueRequests(target, wordlist):
engine = RequestEngine()
for i in range(20):
engine.queue(target, [('X-Alice:', i)])
engine.complete()
# JWT Testing
Use JSON Web Tokens extension
Modify alg: "none", kid: "../../", exp manipulationAdvanced Techniques
SSRF Testing
Use Collaborator to test for blind SSRF in parameters, headers, and file uploads
XSS Discovery
Param Miner + reflect check + storage XSS via site map analysis
Auth Bypass
Test for weak session tokens, authZ via direct object references
API Testing
Import OpenAPI/Swagger specs, test all endpoints systematically
Frequently Asked Questions
What are essential Burp Suite features for bug bounty hunting?
Essential features: Proxy (intercept/modify traffic), Spider (crawl applications), Scanner (automated vulnerability scanning), Intruder (automated attacks/fuzzing), Repeater (manual request testing), Decoder (encoding/decoding), Comparer (response comparison), Extender (BApp extensions). For bug bounty: mastering Proxy, Repeater, Intruder, and active scanner are most important.
How do I configure Burp Suite for optimal testing?
Configuration tips: Set target scope to limit testing, configure proxy listeners (127.0.0.1:8080), enable invisible proxy for non-standard clients, configure SSL pass-through for problematic hosts, set up match and replace rules, configure upstream proxy for anonymity, and enable request timeout handling. In Project Options: enable session handling rules, configure macro for auth bypass, and set thread count for performance.
What Intruder attack types should I use?
Attack types: Sniper (single position, simple fuzzing), Battering Ram (same payload all positions), Pitchfork (different payload per position), Cluster Bomb (all combinations - most thorough). Use Cluster Bomb for parameter combinations (username + password), Pitchfork for matching pairs (ID + name), Sniper for single parameter fuzzing. Set appropriate thread count (10-20) for speed.
What Burp extensions are must-have for bug bounty?
Must-have extensions: AuthMatrix (role-based access testing), JSON Web Tokens (JWT manipulation), Retire.js (JS vulnerability scanning), subdomain analyzer, Turbo Intruder (fast fuzzing), Backslash Powered Scanner (novel detection), Param Miner (parameter discovery), and Collaborator Client (OAST for blind vulnerabilities). Also: nuclei integration, SQLMap bypass rules, and WAF detection.
How do I find more bugs with Burp Suite?
Bug hunting tips: Always test authentication/authorization (authZ bugs pay well), look for IDOR via parameter manipulation, test for SSRF using Burp Collaborator, check for blind XSS with parametric sources, fuzz all parameters including headers, analyze JavaScript files for endpoints and secrets, test race conditions with Turbo Intruder, look for business logic flaws that automated scanners miss, and always verify findings manually before reporting.
Master Bug Bounty with Cyber Defence
Learn web application testing and bug bounty techniques in our ethical hacking course.
View Bug Bounty Course