Ravindra BagaleCourses & study guides

21. Web Application Testing Tools

21.3 Burp Intruder: Automating Requests

By Last updated:

Intruder repeats a request while changing marked positions – useful for testing many inputs (for example, trying an ID from 1 to 50 to find IDOR). Community Edition throttles the speed, which is fine for the lab.

Workflow:

  1. Send a request to Intruder (right-click, "Send to Intruder").
  2. Positions: mark the value to change with § § (for example the id=§1§ in a URL).
  3. Payloads: choose a list – numbers 1–50, or a wordlist of usernames.
  4. Start attack: read the results table; a different status or length often means you found something.

Intruder is powerful – lab only

Running Intruder against a real site is an automated attack and can lock accounts or overload a server. Keep it on DVWA/Juice Shop and your own apps.

Ravindra Bagale's Tip

Results table madhe sagle "200 OK" astat, mag students mhantat "kahich nahi". Length column bagha – jithe length vegli, tithe answer vegla. IDOR shodhtana hech column sarvat mahatvacha.

Lab

In DVWA (or Juice Shop), find a page that takes an id in the URL. Use Intruder with numbers 1–20 in that position and compare the response lengths. Note any id that returns another user's data – that is IDOR, which you will fix in Chapter 27.