21. Web Application Testing Tools
21.3 Burp Intruder: Automating Requests
Intruder repeats a request while changing marked positions – useful for testing many inputs (for example, trying an ID from 1 to 50 to find IDOR). Community Edition throttles the speed, which is fine for the lab.
Workflow:
- Send a request to Intruder (right-click, "Send to Intruder").
- Positions: mark the value to change with
§ §(for example theid=§1§in a URL). - Payloads: choose a list – numbers 1–50, or a wordlist of usernames.
- Start attack: read the results table; a different status or length often means you found something.
Intruder is powerful – lab only
Running Intruder against a real site is an automated attack and can lock accounts or overload a server. Keep it on DVWA/Juice Shop and your own apps.
Ravindra Bagale's Tip
In the results table everything is "200 OK", so students say "nothing found". Look at the Length column – where the length is different, the answer is different. When hunting for IDOR, this column is the most important.
Ravindra Bagale's Tip – मराठी
Results table मध्ये सगळे "200 OK" असतात, मग students म्हणतात "काहीच नाही". Length column बघा – जिथे length वेगळी, तिथे answer वेगळं. IDOR शोधताना हाच column सर्वात महत्त्वाचा.
Ravindra Bagale's Tip – हिंदी
Results table में सब "200 OK" होते हैं, तो students कहते हैं "कुछ नहीं मिला". Length column देखो – जहाँ length अलग, वहाँ answer अलग. IDOR ढूँढते समय यही column सबसे ज़रूरी है.
Lab
In DVWA (or Juice Shop), find a page that takes an id in the URL. Use Intruder with numbers 1–20 in that position and compare the response lengths. Note any id that returns another user's data – that is IDOR, which you will fix in Chapter 27.