Burp Suite Cheat Sheet

General Workflow (Proxy)

• Set browser proxy to 127.0.0.1:8080 (Burp default)
• Intercept toggle: Proxy → Intercept → Intercept is on/off
• Forward a request / drop it / send to Repeater (Ctrl+R)
• Send to Intruder (Ctrl+I), Send to Decoder (Ctrl+U), Send to Comparer

Proxy

• View/edit/intercept raw requests Proxy → HTTP history
• Match/replace automated headers Proxy → Options → Match and Replace (e.g., strip cookies, swap User-Agent)
• Hidden fields visibility: install “Hackbar”-style helpers or use Repeater; reveal hidden params via “Reissue request → modifications”
• TLS: install Burp CA cert at http://burp after proxy is on, trust it in browser

Target / Sitemap

• See all host URLs crawled Target → Site map
• Scope setup: Target → Scope — add host regex, check “Use advanced scope control”
• Highlight/filter: right-click → add to scope; filter history by scope

Repeater

• Repeat any request and hand-edit: useful for testing parameter tampering, SQLi, IDOR
• Switch methods, add headers (X-Forwarded-For, X-Real-IP, Authorization)
• Compare responses between original and modified requests

Intruder (brute force / fuzzing)

1. Send to Intruder
2. Positions tab: select payload position(s) §
3. Payloads tab:
   • Sniper — one position, one wordlist
   • Battering ram — same payload to all positions
   • Pitchfork — parallel wordlists (credential stuffing: usernames+passwords)
   • Cluster bomb — all combos (multi-dim brute force)
4. Options: throttle request throttling, set grep-match for status codes/echo strings, resource pool threads
5. Whitelist responses: sort by status/length to find anomalies

Content Discovery

• Use Burp’s built-in or Intruder with common.txt-style wordlists on directory paths
• Proxy history + Target sitemap reveals hidden routes, backup files, vhosts

Decoder / Comparer

• Decode/hash/decode: base64, URL, HTML, hex; Encode/Decode; Hash tab (MD5, SHA1, SHA256)
• Comparer: diff two responses (e.g., status/error-based SQLi detection)

Extensions (BApp Store)

• Extender → BApp Store
• Common: Logger++ (request logging), Autorize (IDOR automation), Turbo Intruder (high-speed fuzzing), 403 Bypasser, Upload Scanner

Useful Response-Signature Checks (manual)

• SQLi: ' ' OR 1=1-- - and compare lengths/errors
• XSS: <script>alert(1)</script> and check reflection in HTML
• IDOR: swap IDs in path/params and look for unauthorized data
• Auth bypass: X-Forwarded-For: 127.0.0.1, remove Authorization, change method

CLI Alternative (quick checks without GUI)

• curl -x http://127.0.0.1:8080 https://target — route any CLI request through Burp proxy