Mastering Burp Suite

@mastering-burp.agarri.fr

990 Followers 1 Following

Tips and tricks for Burp Suite Pro 🛠️ Not affiliated with @portswigger.net ©️ Managed by @agarri.fr 🇫🇷 Additional free resources 🎁 http://hackademy.agarri.fr/freebies

Screenshot from X: "I dont post that much, but I do when I feel like its worth it - I have to say having taken the Burp suite Pro training by @Agarri_FR I was totally blown away. I have used burp for over 20 years and have learnt so much that will immediately help me, totally recommend the course!"

Screenshot of a note using a few Markdown features (bold, headings, links...)

Burp’s command palette

A Burp Suite session handling rule with the "Match and replace" action. The regexp requires the embedded flag "(?-s)" in order to only impact the "User-Agent" header

Screenshot of the Scalpel script editor using the local `vim` binary

A meme based on the "Change my mind" template (not the Steven Crowder's one, but one from the Calvin & Hobbes comics)

The text says "Chaining two instances of Burp Suite is such an underrated technique"

The event "Skipping brute force of JWT token as maximum time exceeded" appears in Burp Suite event logger.

Cuase: WT tokens use a signature to validate their contents. In some cases, Burp Scanner will attempt to brute-force this signature in order to compromise the token. This error has been caused by Burp Scanner running out of time during the brute-forcing process.

Remedy: To increase the amount of time that Burp Scanner spends brute-forcing JWT token signatures, from the Audit Optimization menu, set Audit speed to Thorough.

Screenshot of the "Network > Connections" section of Burp Suite seetings. The default value for "Failed domain name resolution" is set to 60 seconds

A meme picture displaying the members of a gang. The caption says :
Fuck Turbo Intruder
All my homies use
Send group (parallel)

$The following Python code is executed inside Hackvertor: import sys output = '\n\n'.join(['', sys.version, sys.executable, str(sys.version_info)])$

A meme where a personn says No to "Writing clean Java code" but Yes to "Not checking for NULL in Bambdas"

The samed message editor in Burp Suite, configured with four different fonts: JetBrains Mono, Source Code Pro, Linux Biolinum Keyboard and LM Slanted Mono

A XML document where raw space characters are replaced with Hackvertor's `<@space/>` tags

Screenshot of Burp's HTTP settings, where streaming URLs must be defined

The configuration options in "Settings > Tools > Proxy Default Proxy history message display". We can act separately on Websocket messages, HTTP requests and HTTP responses

This screenshot shows how to use the ellipsis menu in Burp Suite's Repeater in order to switch the tab mode to "Scrolling view"

The response contains a PDF file and it's hard to make sense of its content

Screenshot of the new "Match & Replace" editor, which allows the rule to be tested against a specific request (or response)

Burp Suite interface, but using the Comic Sans font

The title of the Collaborator tab now displays how many unread interactions exist

Using layout 3 in Burp's extension "Menu level"

Screenshot showing the "Popular tags" menu of Hackvertor

The "Upstream proxy server" configuration screen

Using the global search feature in order to identify Javascript files

Changelog of version 2023.3.4 describing the new BCheck grammar

The global search interface, where the filter is set to search only into responses stored in the Proxy History

Testing four different fonts

Changelog for version EA 2023.10

Searching Burp Proxy History using the regex "(?m)User-Agent: burl", which includes an embedded flag