Burp Suite Professional Practical Skills
Burp Suite Professional Practical Skills
This domain tests fluent use of Burp Pro as an exploitation workbench: intercepting, replaying, fuzzing, decoding, and out-of-band collaboration. The exam expects you to configure Burp so it does not fight you, then use Repeater, Intruder, and Collaborator deliberately.
Core rules and concepts
- Proxy: set target scope, filter noise, intercept only in-scope traffic; use match/replace for headers; enable TLS pass-through for client certificates.
- Repeater: use tab groups and renaming; send requests from Proxy; use Request in browser for CSRF PoCs; compare responses with Comparer.
- Intruder: choose attack type carefully-Sniper for one position, Battering ram for the same value, Pitchfork for paired lists, Cluster bomb for all combinations. Add payload processing and grep match/extract.
- Collaborator: generate unique subdomains; poll interactions; use for blind SSRF, XXE, XSS, and OOB injection.
- Session handling: macros can fetch and extract rotating CSRF tokens; cookie jar maintains state; Run a macro on 403 can recover.
- Decoder/Comparer: layered URL, HTML, Base64, and hex decoding; smart decode avoids guesswork.
Worked example
A login form rotates a CSRF token per request. Replaying a captured request returns 403 after the token is used. In Burp, create a session-handling macro that GETs the login page, extracts the token with a regex such as csrf=([A-Za-z0-9]+), and updates the current request. Then set Intruder to Pitchfork with username and password lists, add grep match for Welcome, and run. The reasoning: the macro refreshes state before each attack request; Pitchfork pairs list items rather than testing every combination.
Traps that cost marks
- Leaving Intruder on Sniper when two independent positions need paired payloads.
- Forgetting URL-encoding payloads containing
&,=, or spaces. - Assuming Collaborator DNS and HTTP interactions are equivalent; check which protocol the target uses.
- Creating a macro that matches its own request, causing loops.
- Ignoring response length and status changes that reveal blind success.