If there is one tool that you NEED to have to be a successful Bug Bounty Hunter it would be Burp Suite. You can find plenty of bugs without ever leaving Burp, it is by far the most used and favorite tool among many security professionals. Almost every web attack is performed within Burp. If you don’t know what Burp is, it’s a tool for performing security tests against web applications. The tool acts as a proxy and allows you to inspect, modify, replay, and perform other actions on web requests. Almost every exploit you are going to perform will be done with Burp.
You can access Burp Suite and learn more about it here: https://portswigger.net/burp.
Note that there is a free version (Community) but it is HIGHLY recommended that you purchase a Professional license. This is a must-have tool!
The Proxy Tab: Your Gateway to Web Traffic
The Proxy tab is probably the most important tab in Burp. This is where you can see all of your traffic that passes through the Burp proxy.
Setting Up the Proxy
The first thing you want to do when Burp loads is make sure your proxy is up and running as shown in the below image:
The next step is to force your browser to route its traffic through the Burp proxy. This can be accomplished by changing your browser’s proxy settings, and this will be different depending on which browser you use.
Once you have the Burp proxy listening, the browser configured to use Burp, and you have imported the Burp certificate in your browser (necessary for decrypting HTTPS traffic), you will be good to go. Once you navigate to a web page, you should see the request show up in Burp as shown below:
Intercepting and Modifying Requests
As you can see in the image above, the “Intercept” tab is toggled on. This means that Burp will halt each HTTP request, and you will have to manually press the “Forward” button for the request to continue to the server. While on this tab, you can also modify the requests before forwarding them to the back-end server. However, this tab is generally only used when you are trying to isolate requests from a specific feature. Most of the time, you will normally turn “Intercept” to off and view the traffic in the “HTTP History” tab as shown below:
Analyzing HTTP History
As you can see, the “HTTP History” tab shows each HTTP request and response that was made by and sent to our browser. This is where most security testers spend a significant amount of their time looking for something that sparks their interest.
When looking at the traffic, attention is mostly paid to the method, URL, and MIME type fields. Why? Because when you see a POST method being used, it often suggests vulnerabilities like Stored Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), and many more vulnerabilities. When a URL contains an email, username, or ID, it immediately brings to mind Insecure Direct Object Reference (IDOR) vulnerabilities. When a JSON MIME type appears, the thoughts turn to the back-end API calls. Most of this knowledge of knowing what to look for comes with experience; as you test many applications, you start to see patterns and notice things that look interesting.
Clicking on an HTTP request will show you the client’s request and the server’s response, as can be seen in the image above. Note that while in this view, these values cannot be modified. You will have to send the request to the Repeater if you want to modify the request and replay it, which will be detailed later in this article.
Utilizing the Search Feature
One functionality that is extremely useful for finding a lot of vulnerabilities and making life easier is the search feature. Basically, you can search for a word(s) across all of your Burp traffic. This is extremely powerful and has directly led to finding vulnerabilities.
For example, you may search for the word “url=”. This should show all requests which have the parameter URL in them. These requests can then be tested for Server-Side Request Forgery (SSRF) or open redirect vulnerabilities. You might also search for the header “Access-Control-Allow-Origin” or the “callback=” GET parameter when testing for Same Origin Policy (SOP) bypasses (SOP is a security mechanism that prevents web pages from interacting with resources from a different origin, and a SOP bypass attempts to circumvent this restriction). These are just some examples; your query will change depending on what you’re looking for, but you can find all kinds of interesting leads.
The Burp Proxy tab is where you will spend most of your time, so make sure you are familiar with it. Any traffic that is sent by your browser will be shown in the HTTP History tab; just make sure you have intercept turned off so that you don’t have to manually forward each request.
The Target Tab: Mapping the Application
While generally not the tab where most time is spent, it is still important to know what the Target section of Burp Suite is for.
The Site Map
The “Site Map” sub-tab organizes each request seen by the proxy and builds a site map as shown below:
As you can see in the above image, a site map is built which easily allows us to view requests from a specific target. This becomes fairly useful when encountering an undocumented API endpoint, as this view allows you to build a picture of the possible endpoints. You can also view the HTTP requests in this tab; clicking on a folder in the sitemap will only show requests from that path.
The Scope Tab
In addition to the “Site Map” tab, there is a “Scope” tab. Although rarely used by some, if you want to define the scope of your target, this will limit Burp’s scans (like the scanner or the content displayed in the Site Map) to only the domains in scope.
Intruder: Fuzzing and Brute Forcing
If you are doing any fuzzing (automated sending of unexpected or invalid inputs to an application to find crashes or bugs) or brute forcing with Burp, you’re probably doing it in the “Intruder” tab.
Sending a Request to Intruder
When you find an interesting request, right-click it, then click “Send to Intruder”. This will send your request to the Intruder tab as shown below:
Go to the Intruder tab, and you should see something like this. Now click the “Clear” button to reset everything.
Configuring the Attack
From here, your steps vary depending on what you’re trying to do, but suppose you are trying to do some parameter fuzzing. One of the first things needed is to select the value you are trying to modify. This can be done by highlighting the value and pressing the “Add” button as shown below:
As you can see above, the “cb” parameter value is being selected. Since you are attempting to do parameter fuzzing, this is the value that will be replaced with your fuzzing payloads.
You may have also noticed the “Attack type” drop-down menu is set to “Sniper”. There are four different attack types, which are described in the table below:
| Attack Type | Description |
| Sniper | Uses a single payload list; Replaces one position at a time. |
| Battering ram | Uses a single payload list; Replaces all positions at the same time with the same payload. |
| Pitchfork | Each position has a corresponding payload list; If there are two positions to be modified, they each get their own separate payload list. |
| Cluster Bomb | Uses each payload list and tries different combinations for each position (e.g., Payload 1 from List A and Payload 1 from List B, then Payload 1 from List A and Payload 2 from List B, and so on). |
Adding Payloads
Once you have selected your attack type and the value to be modified, click on the “Payloads” sub-tab.
Here you want to select your payload type and the payload list. There are numerous payload types, but you can keep it on the default one and feel free to play around with the others. For your payload list, you want a list of fuzzing values. For this example, you can use the default lists that come with Burp, but there are some other good lists on SecLists:
https://github.com/danielmiessler/SecLists/tree/master/Fuzzing
To use Burp’s pre-defined list, just click the “Add from list” drop-down menu and select one.
Launching the Attack
Now that you have your fuzzing list imported, all that you have to do is press “Start attack”.
As shown above, after hitting the “Start attack” button, a popup will appear, and you will see your payloads being launched. The next step is to inspect the HTTP responses to determine if there is anything suspicious (e.g., different length, status codes, or error messages).
Intruder is great for brute forcing, fuzzing, and other things of that nature. However, many professionals leverage a plugin called “Turbo Intruder”. If you don’t know what “Turbo Intruder” is, it’s Intruder on steroids; it hits a whole lot harder and a whole lot faster. This plugin can be explored more in the Burp Suite Extender (plugins) section.
Repeater: Modification and Replay
In my opinion, this is one of the most useful tabs in Burp. If you want to modify and replay any request, you do it in the Repeater tab. Similar to Intruder, if you right-click a request and click “Send to Repeater,” it will go to the Repeater tab.
Once the request is sent to the Repeater tab, you will see something like this:
On this tab, you can modify the request to test for vulnerabilities and security misconfigurations. Once the request is modified, you can hit the Send button to send the request. The HTTP response will be shown in the Response window.
You might have noticed that at the top there are a bunch of different tabs with numbers on them. By default, every request you send to the Repeater will be assigned a number. Whenever you find something interesting, you can change this value so you can easily find it later. For example, you might label one of the tabs “SSRF”; it’s a quick, easy way to keep a record of things you are actively testing.
Conclusion: Burp Suite is Indispensable
Burp Suite is the one tool every bug bounty hunter needs in their arsenal. If you’re doing a deep dive on a target application, Burp is the only tool you need. It has a vast amount of plugins (add-ons extending its functionality) to aid in the identification and exploitation of bugs, but its real power comes from allowing attackers the ability to inspect and manipulate raw HTTP requests. Once you learn the basics of Burp, you can perform the vast majority of your hacks using the tool.