Burp features vs. security issues #

The following table answers questions about how to use Burp beyond the regular passive and active Burp Scanner checks for specific security issues.

Security issues	Burp feature	References
Authorization issues	Autorize extension AutoRepeater extension 403 Bypasser extension	Automate your API hacking with Autorize
Cross-site scripting (XSS)	DOM Invader Intruder with appropriate wordlists Hackvertor tags in Burp Repeater, Burp Intruder, and requests sent to Burp Scanner For Blind XSS, manual interaction (e.g., in Burp Repeater) with Burp Collaborator payloads (or Taborator with the `$collabplz` placeholder)	DOM Invader
Cross-site request forgery (CSRF)	AutoRepeater extension (base replacements for CSRF-related parameters)	Cross-site request forgery (CSRF)
Denial of service (DoS)	When using all Burp’s tools, observing. The following: Responses (e.g., “500 Internal Server Error” or “504 Gateway Timeout” server errors) Response time (e.g., in the Start/End response timer column in Burp Logger) Tested application logs (e.g., amount of master locks per minute) Use denial-of-service mode in Burp Intruder
Edge Side Inclusion (ESI) injection	Active Scan++ extension	Server Side Inclusion/Edge Side Inclusion Injection
File upload issues	Upload Scanner extension	Upload Scanner extension tutorials
HTTP request smuggling	HTTP Request Smuggler extension	HTTP request smuggling
Insecure direct object references (IDOR)	Backslash Powered Scanner extension (iterable input detection) Manual interaction in Burp Repeater Burp Intruder with numbers payload type	Testing for IDORs
Insecure deserialization	Freddy, Deserialization Bug Finder extension Java Serial Killer extension Java Deserialization Scanner extension
IP spoofing	Collaborator Everywhere extension Manual interaction in Burp Repeater
JWT issues	JSON Web Tokens extension JWT Editor extension JSON Web Token Attacker (JOSEPH) extension	Working with JWTs in Burp Suite JWT attacks
OAuth/OpenID issues	OAUTH Scan extension	OAuth 2.0 authentication vulnerabilities
Open redirection	Burp Intruder with appropriate wordlists and analysis of the `Location` response Burp Intruder with the `Brute forcer` payload type and special character set, such as `,./\;'[]-=()%`	Open Redirection - PayloadAllTheThings Open Redirect - HackTricks
Race conditions	Backslash Powered Scanner extension Turbo Intruder extension Burp Repeater with requests sent parallelly in a group	Smashing the state machine: the true potential of web race conditions
Rate-limiting bypass	Turbo Intruder extension IP Rotate extension Burp Intruder when using differentiated headers/parameters Bypass WAF extension	Rate Limit Bypass - HackTricks Lab: Bypassing rate limits via race conditions Bypassing API rate limiting using IP rotation in Burp Suite
SAML-based authentication	SAML Raider extension	SAML Attacks - HackTricks How to Hunt Bugs in SAML; a Methodology - Part II
Server-side prototype pollution	Server-Side Prototype Pollution Scanner extension	Server-Side Prototype Pollution Scanner
SQL Injection	Backslash Powered Scanner extension The specific Burp request saved to a text file and passed as a file to the sqlmap tool using the `-r` argument.
Server-side request forgery (SSRF)	Burp Intruder with appropriate wordlists Manual interaction with Burp Collaborator payloads (or Taborator with the `$collabplz` placeholder)
Server-side template injection (SSTI)	Active Scan++ extension