#Burp suite manual manual#

In a typical test, the recon and analysis phase involves the tasks described below. It lets you use Burp's browser to navigate the application, while Burp captures all relevant information and lets you easily initiate further actions. The Proxy tool lies at the heart of Burp's workflow. You can combine Burp's different tools in numerous ways, to perform testing tasks ranging from very simple to highly advanced and specialized. Comparer - This is used to perform a visual comparison of bits of application data to find interesting differences.Decoder - This lets you transform bits of application data using common encoding and decoding schemes.Sequencer - This is used to analyze the quality of randomness in an application's session tokens.Clickbandit - This is used to generate clickjacking exploits against vulnerable applications.Collaborator client - This is used to generate Burp Collaborator payloads and monitor for resulting out-of-band interactions.Repeater - This is used to manually modify and reissue individual HTTP requests over and over.Intruder - This allows you to perform customized automated attacks, to carry out all kinds of testing tasks.Scanner - This is used to automatically scan websites for content and security vulnerabilities.The Burp tools you will use for particular tasks are as follows: Testing for asynchronous vulnerabilities using Burp Collaborator.Credential stuffing using Burp Intruder.Spoofing your IP address using Burp Proxy match and replace.Testing for reflected XSS using Burp Repeater.Viewing requests sent by Burp extensions using Logger.Enumerating subdomains with Burp Intruder.Brute forcing a login with Burp Intruder.Resending individual requests with Burp Repeater.

#Burp suite manual manual#

Augmenting manual testing using Burp Scanner.Intercepting HTTP requests and responses.Step 4: Reissue requests with Burp Repeater.Step 3: Modify requests with Burp Proxy.Step 2: Intercept HTTP traffic with Burp Proxy.