Turbo intruder is a great addition to Burp. I wrote more about it here . Unlike the normal intruder, you control it using Python code. Turns out that from this code, you have access to Burp’s plugin API. Thus, you can also add new requests to the intruder queue from...
Burp
How to write a Burp extension?
Have you ever thought about writing a Burp Suite extension? I certainly have but never really got to do that. Parsia Hakimian, a senior security engineer from Electronic Arts, whose $15k bug was also featured on the channel ($15,000 Playstation Now RCE via insecure...
How to use Burp Macros
Since I saw someone using Burp macros, I've felt like it's a powerful feature that I've only used once or twice during my work. Thankfully, Akshita Gupta has written a whole article about it from which you can learn: what are burp macros how you can use it...
10 Burp Repeater tricks
I've prepared for you 10 tricks you can use in Burp's repeater tool. Those cover only built-in functionalities. Extensions will be covered sometime in the future. Let's get to it! CTRL+space First and foremost, don't use the bloody mouse to send the...
8 non-obvious Burp intruder tricks
Intruder is my second most often used active functionality of Burp, after repeater of course. For a long time, I had been using this tool inefficiently. I just didn't know about it. Now I've learnt a bit and I'm happy to share 8 non-obvious tips that will improve your...
Turbo Intruder observedWords
If during the passive scan you mark learn observed words setting, you will have the observedWords wordlist available to you in the Turbo Intruder. It's a dynamic list of words that Burp sees in your target. You can access it by wordlists.observedWords....
Finding DOM-XSS with DOM invader
DOM invader is 2021’s addition to Burp Suite. If you are a long-time reader of the newsletter, you know how highly I rated filedescriptor’s Untrusted-Types for finding DOM-XSS. Well, DOM invader is even better. I’ll walk you through the usage of it. Enabling DOM...
Installing Burp Collaborator instance
Burp Collaborator is an awesome tool and I probably don’t need to tell you that. However, there are a few problems with using the Portswigger’s server: Disclosing sensitive information to 3rd party company. Depending on what you hack, it may or may not be a problem....
10 Burp shortcuts that will help you hack quicker
As said in the SQL injection article, to find great bugs you need a lot of time. How to save time? One of the things you can do is using shortcuts instead of using a mouse for common functionalities in Burp. Here are my top 10 shortcuts that will make your work...
Comparing site maps in Burp
I don’t know since when there is the feature in Burp of comparing sitemaps but I only heard about it recently. You can compare the sitemap from your between Burp’s projects. I think for this purpose, it would be good to save Burp’s project in a separate file once in a...