Burp Suite
Burp Suite is PortSwigger’s integrated platform for web application security testing. It bundles an intercepting proxy, vulnerability scanner, and a set of manual tools (Repeater, Intruder, Decoder, Sequencer, Comparer) into one UI, and is the de facto industry standard for web pentesting. The Community Edition ships free (and is pre-installed on Kali Linux); the Professional edition adds the scanner, Burp Collaborator, and various automation features.
Alternatives in the same space: OWASP ZAP (free, open source) is the closest competitor.
Keyboard shortcuts
Ctrl + Shift + D— Switch to DashboardCtrl + Shift + T— Switch to TargetCtrl + Shift + P— Switch to ProxyCtrl + Shift + I— Switch to IntruderCtrl + Shift + R— Switch to RepeaterCtrl + F— Forward intercepted requestCtrl + U— URL-encode selected text in Proxy > InterceptCtrl + R— Send request from Proxy to RepeaterCtrl + R— Send request from Proxy to Intruder (same key, context-dependent)
Target
Scope
Sites can be added to the project scope under Target > Scope, or by right-clicking a site in Target > Site map. When you add via Site map, Burp prompts you to turn off logging for out-of-scope items; you can change that later in Logger by clicking the “Capture filter” bar and checking “Capture only in-scope items (Suite scope)”.
You can further restrict the Proxy to intercept only in-scope requests under Proxy > Options > Intercept Client Requests by enabling “And URL is in target scope”.
Issue definitions
Target > Issue definitions lists every issue type used by the vulnerability scanner in the paid version. On the Community Edition it’s not wired to a scanner, but it doubles as a massive (and very useful) reference for web vulnerability classes — worth browsing when learning a new bug type.
Intruder attack types
Intruder automates repeated requests with payload substitution. The four attack types differ in how payloads map to positions.
Sniper
Sniper takes a single word list and inserts each element into each defined position, one element and one position at a time.
With a word list [one, two, three] and body foo=position1&bar=position2:
foo=one&bar=position2
foo=two&bar=position2
foo=three&bar=position2
foo=position1&bar=one
foo=position1&bar=two
foo=position1&bar=three
Most useful when attacking a single position (e.g., fuzzing one parameter).
Battering ram
Battering ram takes a single word list and inserts the same payload into every position on each run:
foo=one&bar=one
foo=two&bar=two
foo=three&bar=three
Niche use — handy when the same value legitimately appears in multiple places (e.g., a token echoed in both a form field and a header).
Pitchfork
Pitchfork takes one word list per position and iterates through them in lockstep. All lists should be the same length; Pitchfork stops at the end of the shortest list.
With lists [one, two, three] and [alpha, beta, gamma]:
foo=one&bar=alpha
foo=two&bar=beta
foo=three&bar=gamma
The standard approach for testing known username/password tuples — pairs stay aligned.
Cluster bomb
Cluster bomb takes one word list per position and tests every combination:
foo=one&bar=alpha
foo=one&bar=beta
foo=one&bar=gamma
foo=two&bar=alpha
...
foo=three&bar=gamma
The right choice when you don’t know the credentials and want to fuzz a login form with a likely-values wordlist (e.g., rockyou.txt). Also the most expensive attack in requests/time — and the one most likely to get you noticed.
Burp Collaborator (out-of-band testing)
Burp Collaborator is a network service run by PortSwigger that enables detection of invisible vulnerabilities — bugs that produce no error message, no output difference, and no timing signal in the response. It’s the engine behind Burp’s out-of-band application security testing (OAST). 1
The general flow:
- Burp generates a unique Collaborator payload (a random subdomain like
xyz.oastify.com) and embeds it in an attack request. - If the target is vulnerable, it triggers some interaction with that subdomain — a DNS lookup, an HTTP request, an SMTP connection.
- The Collaborator server, which is authoritative for its domain, records the interaction.
- Burp polls the server and reports the interaction back to you, revealing the vulnerability.
Collaborator shines for bug classes that are otherwise hard to confirm: blind XSS that fires on an admin panel you can’t see, blind XXE, server-side request forgery (SSRF), and asynchronous code injection. Burp Scanner (Professional) uses Collaborator automatically in many of its checks; in Professional you can also use the Burp Collaborator client manually to generate payloads and poll for interactions. A private Collaborator server can be deployed for engagements that forbid third-party infrastructure. 2
Decoder
Burp’s Decoder displays hashes in “Hex” view by default. To convert a hash into the (hex) ASCII string you’re used to seeing, encode the output as “ASCII Hex”.
Macros and session handling
When forms include session cookies or anti-CSRF tokens, there are two approaches:
- Recursive Grep in Intruder — extract the token from the previous response directly within an Intruder attack. Works when the token is straightforwardly returned in a predictable spot.
- Project options > Sessions > Macros — necessary when there’s, e.g., a random redirect complicating things. A macro defines a sequence of requests Burp replays before the “real” one.
Once a macro is defined, add an entry in Session Handling Rules and set its Scope: which tools it applies to (Proxy, Repeater, Intruder, Scanner) and which URLs it matches. Restrict scope as tightly as possible — both the URLs and the specific parameters/cookies the macro updates — to avoid Burp firing the macro on every request and slowing everything down.
Sources
- Burp Suite documentation
- Burp Collaborator
- Burp Collaborator (Desktop Tool)
- Introducing Burp Collaborator
- Web Security Academy
Related: burp-suite-firefox, burp-suite-aws-cli-proxy, owasp-zap, xss-attacks, xxe-attacks