Burp Suite
InformationalBurp Suite
Definition
Burp Suite is the reference tool for web application security testing, developed by PortSwigger. It works as an HTTP/S proxy that intercepts, modifies and replays requests between the browser and the server. It includes tools such as Repeater (replaying requests), Intruder (fuzzing), Scanner (automatic vulnerability detection) and extensions such as Logger++ and Autorize.
Impact
Examples
Typical Burp Suite workflow
1) Configure the browser to use Burp as a proxy (127.0.0.1:8080). 2) Browse the application to map the attack surface (Target > Site Map). 3) Intercept interesting requests (Proxy > Intercept). 4) Send requests to Repeater to modify them and test variations. 5) Use Intruder to automate parameter fuzzing. 6) Install extensions such as Autorize for automatic authorization testing.
Essential Burp Suite extensions
The most popular extensions for bug bounty are: Autorize (automatic authentication/authorization testing), Logger++ (advanced request logging), Param Miner (hidden parameter discovery), Turbo Intruder (ultra-fast fuzzing for race conditions), Active Scan++ (scanner improvements), and JSON Web Token Attacker (JWT attacks).