Ravindra BagaleCourses & study guides

21. Web Application Testing Tools

21.3 Burp Intruder: Automating Requests

Intruder repeats a request while changing marked positions – useful for testing many inputs (for example, trying an ID from 1 to 50 to find IDOR). Community Edition throttles the speed, which is fine for the lab.

Workflow:

  1. Send a request to Intruder (right-click, "Send to Intruder").
  2. Positions: mark the value to change with § § (for example the id=§1§ in a URL).
  3. Payloads: choose a list – numbers 1–50, or a wordlist of usernames.
  4. Start attack: read the results table; a different status or length often means you found something.

Intruder is powerful – lab only

Running Intruder against a real site is an automated attack and can lock accounts or overload a server. Keep it on DVWA/Juice Shop and your own apps.

Ravindra Bagale's Tip

In the results table everything is "200 OK", so students say "nothing found". Look at the Length column – where the length is different, the answer is different. When hunting for IDOR, this column is the most important.

Lab

In DVWA (or Juice Shop), find a page that takes an id in the URL. Use Intruder with numbers 1–20 in that position and compare the response lengths. Note any id that returns another user's data – that is IDOR, which you will fix in Chapter 27.