Burp Suite Tutorial

Dashboard Configuration

Configure how the Dashboard displays information and handles new findings.

# Configure issue tracking:
# Tools > Database > Options > Issue Tracking

# Set new issue alerts:
# - Play sound for new issues
# - Show popup notification
# - Always collapse when starting new task

# Issue definitions:
# - Customize severity levels
# - Define custom issue types
# - Set remediation advice

Scope Sub-Tab

Define exactly which targets you are authorized to test, ensuring focused and legal security testing.

# Scope Configuration:
# - Include Rules: URLs to test
# - Exclude Rules: URLs to avoid

# URL Pattern Examples:
# - https://example.com (exact)
# - .*.example.com.* (subdomains)
# - https://api.example.com/v[0-9]+/* (API versions)

# Scope Enforcement:
# - Don't send items to Proxy
# - Don't send items to Scanner
# - Only spider within scope
# - Only check in-scope items

# Use Cases:
# - Bug bounty testing
# - Penetration test scoping
# - Exclude logout endpoints
# - Exclude admin panels (if out of scope)

Payload Types

# Simple List:
# - Load wordlists from file
# - Runtime file list for large lists
# - Paste custom payloads

# Runtime File:
# - Efficient for massive wordlists
# - Streamed from disk, not memory
# - Great for thousands of entries

# Numbers:
# - Sequential number sequences
# - Step: increment value
# - RADIX options: decimal, hex, octal
# - Format string customization

# Brute Forcer:
# - Character set definition
# - Length range specification
# - Min/Max character sets

# Empty Payloads:
# - Repeat previous payload
# - Null payloads (original value)
# - Character frobber (sequential char changes)

# Case Modification:
# - Add custom rules
# - Case modifications
# - Find/Replace operations
# - Bit flipper for binary fuzzing
# - Unicode scrambler

Practical Intruder Use Cases

Example 2: Testing for XSS in Search Parameter

# 1. Locate search functionality
#    - Browse the target
#    - Make a search request

# 2. Analyze the request
#    - Check if output is reflected
#    - Find if reflected in HTML, JS, or attribute

# 3. Test basic XSS:
GET /search?q=<script>alert(1)</script>

# 4. Test different contexts:
?q=</script><script>alert(1)</script>
?q=<img src=x onerror=alert(1)>
?q=<svg onload=alert(1)>
?q='onclick=alert(1)//

# 5. Use Intruder for encoding bypass testing:
#    - Payload: <script>alert(1)</script>
#    - Add processing: URL-encode
#    - Double-encode payloads
#    - Mixed encoding tests

Example 3: Session Hijacking Testing

# 1. Capture session tokens
#    - Login to application
#    - Capture session cookie
#    - Note the format

# 2. Analyze with Sequencer
#    - Send to Sequencer
#    - Collect 10,000+ samples
#    - Run entropy analysis

# 3. Test token predictability
#    - Session ID: SESSION=a1b2c3d4
#    - Analyze structure
#    - Check for sequential IDs
#    - Look for time-based patterns

# 4. Test session Fixation
#    - Obtain valid session
#    - Force user to use it
#    - Check if session changes post-auth
#    - Send session to Repeater for testing

# 5. Check session timeout
#    - Leave session idle
#    - Check timeout behavior
#    - Review session renewal

Example 4: IDOR Testing in User Profile

# 1. Log in as User A
#    - Navigate to Profile
#    - Request: GET /api/user/1001/profile

# 2. Capture the request
#    - Send to Repeater
#    - Note the parameter format

# 3. Test IDOR:
#    - Change to User B's ID
#    - GET /api/user/1002/profile
#    - Check if data is returned

# 4. Use Intruder for mass testing:
#    - Capture valid ID as template
#    - Pitchfork with numbers 1001-2000
#    - Check for successful (data leak) vs 403

# 5. Check for Horizontal/Vertical privilege escalation
#    - Admin to user data access
#    - User to admin panel access
#    - Cross-tenant data access

Example 5: API Security Testing

# 1. Discover API endpoints
#    - Site Map will list discovered APIs
#    - Look for /api/, /v1/, /v2/ paths
#    - Check Swagger/OpenAPI docs

# 2. Test API authentication
#    - Request without token (401?)
#    - Request with invalid token
#    - Test token expiration

# 3. Test HTTP methods
#    - GET /api/users
#    - POST /api/users
#    - PUT /api/users/1
#    - DELETE /api/users/1
#    - PATCH /api/users/1
#    - Check for proper method enforcement

# 4. Test for mass assignment
#    - Create request with extra fields
#    - POST with "role": "admin"
#    - Check if fields are accepted

# 5. Use Decoder for JWT testing
#    - Decode JWT tokens
#    - Analyze claims
#    - Test algorithm confusion
#    - Check for "none" algorithm

What is Burp Suite used for in web security testing?

Burp Suite is a comprehensive web application security testing platform used by security professionals to identify vulnerabilities. It intercepts HTTP/HTTPS traffic, automates vulnerability scanning, and provides tools for manual testing including proxy, scanner, intruder, repeater, decoder, and more. It is considered the industry standard for web application penetration testing.

How does the Proxy tab in Burp Suite work?

The Proxy tab acts as an HTTP/HTTPS proxy server that intercepts all traffic between your browser and target applications. It features three main sub-tabs: Intercept for modifying requests on-the-fly, HTTP History for logging all requests, and WebSockets for websocket traffic analysis. Toggle intercept mode to pause and modify requests before they reach the server. You can also configure match and replace rules to automatically modify traffic.

What is the difference between active and passive scanning in Burp Suite?

Passive scanning analyzes existing traffic without sending additional requests, checking for issues like information disclosure, missing security headers, and potential vulnerabilities in captured data. It is silent and produces no footprint. Active scanning sends crafted requests to the target to actively probe for vulnerabilities like SQL injection, XSS, command injection, path traversal, and other exploitable weaknesses. Active scanning should only be performed on authorized targets as it generates simulated attack traffic.

How do I use Burp Intruder for fuzzing and bruteforcing?

Burp Intruder automates customized attacks by allowing you to define injection points in requests and configure payload sets. It supports multiple attack types including Sniper for single payload at each point, Battering Ram for same payload at all points, Pitchfork for multiple payload sets in parallel, and Cluster Bomb for all combinations. Use it for parameter fuzzing with wordlists, credential bruteforcing with username/password combinations, and enumerating valid values like user IDs or product codes.

What are the best Burp Suite extensions for web security testing?

Essential Burp Suite extensions include: Active Scan++ for enhanced vulnerability scanning with additional checks, Logger++ for comprehensive request/response logging to a searchable table, AutoRepeater for automatic request modification and replay rules, JSON Beautifier for formatting JSON responses, Hackvertor for advanced tag-based encoding and decoding, Autorize for automatic authorization testing, and Burp Collaborator for detecting out-of-band vulnerabilities like SSRF, blind SQL injection, and blind XSS.

Can Burp Suite detect all types of web vulnerabilities?

Burp Suite Professional automated scanner can detect over 300 vulnerability types including SQL injection, cross-site scripting (XSS), command injection, path traversal, information disclosure, authentication flaws, session management issues, access control problems, and more. However, manual testing with tools like Repeater, Intruder, and Sequencer is often necessary to find complex business logic vulnerabilities, race conditions, authentication flaws, and vulnerabilities that require specific test cases that automated tools may not generate.

What is the Burp Suite Sequencer used for?

The Burp Suite Sequencer analyzes the randomness and unpredictability of tokens, session identifiers, anti-CSRF tokens, and other security-critical data. It collects samples and performs multiple statistical tests to determine if tokens have sufficient entropy for security purposes. Weak randomness in session tokens can lead to session hijacking attacks where attackers predict valid session IDs. Weak anti-CSRF tokens can be brute-forced, enabling cross-site request forgery attacks. The Sequencer helps identify these critical vulnerabilities before attackers exploit them.