Burp Suite in depth: Intruder, session rules and extensions
Using Intruder attack types, session handling rules, macros and extensions, you test access control systematically in a multi-role lab app.
Level 201 · 16 lessons · 14 practice labs
Lessons
Mastering Intruder
- Attack types: Sniper, Battering ram, Pitchfork and Cluster bomb
- Payload processing rules and encoding
- Reading results: grep match, length and timing columns
- Speed and concurrency: testing without overloading your own app
- Short task: measure username enumeration in the lab app with Intruder
Working with sessions
- Session handling rules: renewing an expired session automatically
- Macros: refreshing the CSRF token on every request
- Match and replace: swapping roles and headers automatically
- Testing with two users: comparing access control
- Short task: replay admin requests with a low-privilege session
Visibility and extensions
- Logger and advanced search: seeing every tool’s traffic
- The BApp Store: choosing and installing trusted extensions
- Building an access matrix with authorisation-check extensions
- Intercepting and replaying WebSocket messages
- Project settings: TLS, HTTP/2 and upstream proxies
- Capstone: build and report the access matrix of a multi-role app with Burp
Practice labs
- Username enumeration with Sniper: Run a Sniper attack with a short user list on the login page, find the response length difference and make the responses identical.
- Separate the successful response with grep match: Set a grep match rule in Intruder results to find the single different response and explain why it differs.
- User-PIN pairs with Pitchfork: Use Pitchfork with paired user and PIN lists to prove there is no attempt limit and add a per-account limit.
- Username enumeration by response time: Measure the difference in the response time column that reveals existing users and close it with constant-time verification.
- A signed parameter with payload processing rules: Test a parameter that needs a hash on every request by generating correct values with payload processing rules and show why the hash gives no protection.
- Renew an expiring session automatically: Set a session handling rule for a lab app with a short-lived session and show a long scan runs without interruption.
- A macro that refreshes the CSRF token on every request: Write a macro for a flow that wants a new CSRF token on every form and send successive successful requests from Repeater.
- Swapping a role header with match and replace: Change a role header on every request with a match-and-replace rule and find the endpoints where the server trusts this header.
- Replay admin requests with a low-privilege session: Replay requests recorded with an admin session using a staff session, find two unprotected actions and add the role check.
- Every tool's traffic in Logger: Filter Intruder and Repeater traffic in Logger to find every request where a given parameter value appears.
- A three-role access matrix with an authorisation extension: Run an authorisation checking extension with customer, staff and admin sessions and fix the two wrong permissions in the matrix.
- Tamper with a WebSocket chat message: Prove that changing the sender field in the chat app's WebSocket message lets you write as someone else and take it from the session on the server.
- Reading history without permission over WebSocket: Replay a WebSocket message that requests another chat room's history, add the authorisation check and log refused requests.
- Access matrix report: the Kalvera Help Desk: Compare every role of the fictional Kalvera Help Desk app with Burp, close the gaps in the matrix and deliver the retested matrix.
About this course
Using Intruder attack types, session handling rules, macros and extensions, you test access control systematically in a multi-role lab app.
What you will learn
- Mastering Intruder
- Working with sessions
- Visibility and extensions
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.