Imported from Mriskiali/jb (
skills/hacktricks_skills/todo/burp-suite/SKILL.md). Install upstream withnpx skills add Mriskiali/jb --skill burp-suite. Copyright stays with the author.
Hacktricks: Burp Suite
Auto-generated by Cybermes converter
Original source: Hacktricks Book
This skill contains comprehensive exploitation guides, attack patterns, and defensive recommendations.
Burp Suite
Intruder payload types
Burp Intruder includes the following built-in payload generators and transformations:[1]
- Simple list: Use a configured list of strings as payloads.
- Runtime file: Read one payload per line at runtime. This is useful for large lists because Burp does not load the entire file into memory.
- Case modification: Generate the unmodified value, lowercase and uppercase forms,
Propername(first letter uppercase and the rest lowercase), orProperName(first letter uppercase with the remaining characters unchanged). Burp discards duplicate results. - Numbers: Generate sequential or random numbers within a configured range.
- Brute forcer: Generate every permutation for a chosen character set and minimum/maximum length.
Extensions and companion tools
- Collabfiltrator generates payloads that execute commands and exfiltrate their output through DNS queries to Burp Collaborator.[2]
- Burp Suite Exporter exports Burp findings for use in other reporting workflows.[3]
- HTTP Script Generator converts HTTP requests into scripts in several languages.[4]
References
- [1] PortSwigger documentation - Burp Intruder payload types
- [2] GitHub - 0xC01DF00D/Collabfiltrator
- [3] ArtsSEC - Burp Suite Exporter
- [4] GitHub - h3xstream/http-script-generator
Related Skills
This complements:
See also:
- Cybermes - Full exploit toolkit
Usage Examples
# Example commands from this technique go here
python sqli_exploit.py -u "target.com/page?id=1" -p id
For full details, refer to the original Hacktricks documentation.
