Burp Suite Pro Secrets: Techniques They Don't Teach in Courses

[Blacksec]

Burp Suite Pro Secrets: Techniques They Don't Teach in Courses ​

---

> Posted by: proxy_phantom | Rank: Legend | Joined: 2021 [/I]

---

Spoiler: What This Covers

• Advanced repeater techniques
• Intruder customization
• Macro automation
• Extender API development
• Bypassing WAFs with Burp

Alright, if you're using Burp Suite and only doing basic manual testing, you're leaving money on the table.

I've been doing web app security for 7+ years. Burp Suite is my bread and butter. Today I'm sharing the advanced techniques that separate the professionals from the script kiddies.

---

━━━ ADVANCED REPEATER WORKFLOW ━━━[/B]

The Professional's Repeater Setup:

1. Enable "Auto-match" in Repeater options
2. Set up multiple request templates in the "Item Links" panel
3. Use "Send to Intruder" for bulk testing
4. Create macros for authenticated sessions
5. Save common payloads in the "Payloads" tab

Quick Tip: Press

Ctrl+R

to resend the last request. Use

Ctrl+Shift+R

for the request before that. Keyboard shortcuts make you 10x faster.

---

━━━ INTRUDER MASTERCLASS ━━━

Cluster Bomb vs Battering Ram vs Pitchfork:

# Cluster Bomb: All payloads x all payloads
# Use when testing multiple injection points
/settings?id=1&mode=admin&debug=true
# 100 payloads × 100 payloads = 10,000 requests

# Battering Ram: Same payload at all positions
# Use when all params need the same value
/search?q=XSS_PAYLOAD&filter=XSS_PAYLOAD&sort=XSS_PAYLOAD

# Pitchfork: Parallel payloads (1st with 1st, 2nd with 2nd)
# Use for credential stuffing
username: admin, test, user
password: password123, 123456, letmein
# admin+password123, test+123456, user+letmein

Advanced Payload Settings:

# URL Encoding (only specific characters)
Payload encoding: URL

# Hex encoding for bypass
Payload encoding: Hex

# Base64 encoding
Payload encoding: Base64

# Custom interpolation
Payload processing: Add prefix/suffix
Example: {payload}_test or test_{payload}

---

━━━ MACRO AUTOMATION ━━━

What's a Macro? A macro is an automated sequence of requests that handles authentication or complex flows.

# Example: Login Macro
1. GET /login (capture CSRF token)
2. POST /login (with credentials + token)
3. GET /dashboard (verify login worked)

# How to set it up:
1. Go to Intruder → Positions
2. Click "Auto" to capture a request
3. Right-click → "Capture as macro"
4. Define which request is the "login" request
5. Apply macro to all subsequent requests

Pro Tip: Save your macros as .burp files. You can share them with your team or reuse them across engagements.

---

━━━ EXTENDER API - BUILD YOUR OWN TOOLS ━━━

Python Extension Example:

#!/usr/bin/env python3
"""
Burp Suite Extension: Automated XSS Detector
"""
import sys
from burp import IBurpExtender, IMessageEditorTab, IMessageEditorTabFactory
import re

class BurpExtender(IBurpExtender, IMessageEditorTabFactory):
    def registerExtenderCallbacks(self, callbacks):
        self.callbacks = callbacks
        self.helpers = callbacks.getHelpers()
        callbacks.setExtensionName("XSS Detector")
        callbacks.registerMessageEditorTabFactory(self)
        print("[+] XSS Detector extension loaded")
    
    def createNewInstance(self, controller, editable):
        return XSSTab(self, controller, editable)

class XSSTab(IMessageEditorTab):
    def __init__(self, extender, controller, editable):
        self.extender = extender
        self.editable = editable
        self.highlight = None
        self.label = "XSS Analysis"
        
    def getTabCaption(self):
        return self.label
    
    def getUiComponent(self):
        return self.component
    
    def isModified(self):
        return self.editable
    
    def getSelectedData(self):
        return self.selected_data
    
    def setMessage(self, content, isRequest):
        if content:
            self.analyze_xss(content)
    
    def clear(self):
        pass
    
    def analyze_xss(self, message):
        # Extract request/response
        text = message.decode('utf-8', errors='ignore')
        
        # Check for XSS indicators
        patterns = {
            'script_tag': r'<script.*?>',
            'event_handler': r'on\w+\s*=',
            'javascript_uri': r'javascript:',
            'svg_onload': r'<svg.*?onload',
            'img_onerror': r'<img.*?onerror',
        }
        
        results = []
        for name, pattern in patterns.items():
            if re.search(pattern, text, re.IGNORECASE):
                results.append(f"[!] Found {name}: {pattern}")
        
        # Display results
        if results:
            self.highlight = "\n".join(results)
        else:
            self.highlight = "[+] No obvious XSS patterns detected"

if __name__ == "__main__":
    print("Load this in Burp Suite Extensions tab")

How to load: Burp Suite → Extensions → Add → Choose Python → Browse to script

---

━━━ WAF BYPASS WITH BURP ━━━

Using Burp's Decoder for Bypasses:

# Right-click in Repeater → Decoder
# Try these encodings:
• URL encoding (double, triple)
• Unicode encoding (%uXXXX)
• Hex encoding (0xXX)
• HTML entity encoding (&#xXX;)
• Base64 encoding
• Mixed encoding

Active vs Passive Scanning:

# Active scan (aggressive, can be detected)
Projects → Target → Scope → Right-click → Do active scan

# Passive scan (quiet, analyzes existing traffic)
Automate → Spider → Start spidering

---

━━━ ADVANCED BURP CONFIG ━━━

# Session handling rules
1. Right-click in Proxy → Session handling rules → Add
2. Add rule for CSRF token extraction
3. Set action: Header rule → Add header
4. Value: Extract from response using regex

# Match and replace rules
1. Tools → Match and Replace → Add rule
2. Match: "X-Frame-Options: DENY"
3. Replace: "" (empty)
4. This strips security headers for testing

# Request rate limiting
1. Proxy → Options → Rate Limit
2. Set max requests per minute
3. Prevents getting rate-limited by target

---

━━� BRPICKLE - AUTOMATED TESTS ━━━

# Save requests as BRPICKLE files
# Repeater → Right-click → Save items

# Run saved tests programmatically
# Import into Burp Suite → Right-click → Load from file

# Can be shared between team members
# Great for standardized testing

---

━━━ BULK TESTING WORKFLOW ━━━

# 1. Spider the target
Burp Spider → Start spidering

# 2. Export sitemap
Target → Site map → Right-click → Export site map

# 3. Load into Intruder
Intruder → Positions → Load from file

# 4. Set up payload sets
- payload set 1: XSS payloads
- payload set 2: SQLi payloads
- payload set 3: Command injection

# 5. Run attack
Intruder → Start attack

# 6. Filter results
Search → grep → "200 OK" + any payload indicator

---

━━━ TL;DR ━━━

✅ Use macros for authenticated testing
✅ Master Cluster Bomb for multi-param testing
✅ Write custom extensions for specialized tasks
✅ Save BRPICKLE files for reproducibility
✅ Use Match and Replace for header manipulation
✅ Automate repetitive tasks with Extender API

---

Got Burp tips? Drop 'em below. What's your favorite extension?
Next: Advanced OSINT gathering with Maltego and theHarvester.

Last edited by proxy_phantom; 4 hours ago.

---

[SIG]━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
proxy_phantom | Legend | Web App Security
"The proxy is your window into the application"
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━[/SIG][/b][/b][/b][/b][/b][/b]