Mastering Burp Suite Pro, 100% hands-on

"This is not a book about astronomy; rather, this is a book about telescopes" - PoC||GTFO Volume II

Our own publications

Tips and tricks

We manage the @MasteringBurp account, which regularly posts Burp Suite tips and tricks.

Talk at Tumpicon 2025

The 15-minute talk "Python3-based read/write editors in Burp Suite" covers the extensions Piper and Scalpel.

First, the target (a AES-ECB CTF challenge) is introduced. Then a read-only viewer is created in Piper, using a Bash one-liner. This viewer is used to nicely display the encrypted cookie and its blocks. We finally move to a read-write editor, this time with Scalpel and Python3. This editor allows us to easily modify the encrypted data by shuffling blocks around.

Workshop at NahamCon 2023

The 70-minute workshop "Automation tricks for Burp Suite Pro" is fully hands-on: the targets used during the demos are provided as free Docker containers.

Three main subjects are covered:
  • Handling CSRF tokens in Intruder (using Recursive Grep + Pitchfork)
  • Session management for Web apps (handling CSRF tokens in a generic way)
  • Session management for Web APIs (dealing with authorization headers and JWT)

Talk at Northsec 2023

The 30-minute talk "Tips and tricks for Burp Suite Pro, ten years later" details some efficiency tips, covering both core features (Proxy History, Repeater, Intruder and Collaborator) and some extensions (Hackvertor and Piper).

Blog

We publish articles from times to times, on Agarri's corporate blog or elsewhere...

Use Burp's Intruder to its full advantage (link)

  • Hotkeys

  • Useful payload types

  • Processing responses automatically

  • Additional tips


Exploiting WPAD with Burp Suite and the "HTTP Injector" extension (link)

  • Redirect other users' traffic to yourself using WPAD

  • Exclude SSL traffic from interception (avoid client-side warnings)

  • Develop a custom extension infecting HTTP traffic (f.e. injecting a BeEF hook)

  • Test the setup on eBay


Exploiting a Blind XSS using Burp Suite (link)

  • Use Burp Collaborator to detect a blind XSS

  • Use Burp Collaborator to exfiltrate data from the victim's browser (cookies!!)

  • Use the stolen cookie via a Match & Replace rule

  • Browse the admin interface and get a flag


Deserialization in Perl v5.8 (link)

  • Spot a HTML form with a hidden parameter whose value is Base64-encoded

  • Fuzz the value using the "Character Frobber" payload type in Intruder

  • Identify a Perl deserialization vulnerability

  • Exploit the vulnerability in Repeater and get RCE


Intruder and CSRF-protected form, without macros (link)

  • Setup a local "Damn Vulnerable Web Application" target

  • Analyze the login flow, using a browser and Proxy History

  • Log in using Repeater (manually dealing with redirects and CSRF tokens)

  • Use Intruder's Recursive Grep to transparently manage CSRF tokens, w/o macros

  • Run a brute-force attack in Intruder and find the admin password

Third-party resources

Bugcrowd video (by Jasmin Landry)

Former attendee @JR0ch17 (aka Jasmin Landry) published a video listing plenty of tricks we covered during the training. His Advanced Burp Suite video is available online via the Bugcrowd University.

HackerOne videos (by Cody Brocious and James Kettle)

There's a 3-video playlist on Hacker101:

Challenges

We recommend the WebSecurity Academy, by PortSwigger. We also heard good things about PentesterLab (paid, but some free labs are available).

Burp Suite Community

The Community Edition version of Burp Suite has some limitations, but is nonetheless a good starting point. Don't miss its great documentation.

Burp Suite Pro

If you're lucky (or wise) enough to use the Pro Edition of Burp Suite, here is a dozen of dedicated resources selected by Portswigger.